Support Center > Search Results > SecureKnowledge Details
"DLP Recipients" field in DLP log contains truncated e-mail addresses
Symptoms

  • The following DLP logs appear in SmartView Tracker:

    • UserCheck section 
      User Response = Pending
UserCheck Message to User = Email was flagged as Confidential Please enter a reason for this action
Confirmation Scope = For this rule
    • User Information section 
      DLP Recipients = e-mail addresses are truncated at random place

      Example:



    • DLP Type section 
      Action = Ask User
DLP Action Reason = Rule Base
Message to User = DLP violation occurred
    • Traffic section 
      Destination = Mail_Server
Service = smtp (25)
File Direction = internal to external

  • Debug of in.emaild.smtp daemon (per sk60387) shows in $FWDIR/log/emaild.smtp.elg:

    CBinObjCommon::PackLogData: too long string (XXX bytes) was truncated
CBinObjCommon::PackLogData: Field number:14, Data offset:NNN, Type:eFtCstring, Value: email_1@domain, email_2@domain, email_3@domain, ...
Cause

The current size of the field that holds the e-mail addresses in a log is not enough to hold all the e-mail addresses.
As a result the "recipients" field sent from in.emaild.smtp process is cut off at some random location by the infrastructure (the location is not related to e-mail address structure). On a later stage, list of e-mails is sorted, and the triuncated e-mail moves to some place in the middle of this list.


Solution
 Note: To view this solution you need to Sign In .