"DLP Recipients" field in DLP log contains truncated e-mail addresses

Support Center > Search Results > SecureKnowledge Details

"DLP Recipients" field in DLP log contains truncated e-mail addresses

Technical Level

Solution ID	sk103635
Technical Level
Product	Data Loss Prevention
Version	R77.20, R77.10 (EOL), R77 (EOL)
Platform / Model	All
Date Created	30-Dec-2014
Last Modified	20-May-2015

Symptoms

The following DLP logs appear in SmartView Tracker:

UserCheck section

User Response = Pending
UserCheck Message to User = Email was flagged as Confidential Please enter a reason for this action
Confirmation Scope = For this rule

User Information section

DLP Recipients = e-mail addresses are truncated at random place

Example:

DLP Type section

Action = Ask User
DLP Action Reason = Rule Base
Message to User = DLP violation occurred

Traffic section

Destination = Mail_Server
Service = smtp (25)
File Direction = internal to external

Debug of in.emaild.smtp daemon (per sk60387) shows in $FWDIR/log/emaild.smtp.elg:

CBinObjCommon::PackLogData: too long string (XXX bytes) was truncated
CBinObjCommon::PackLogData: Field number:14, Data offset:NNN, Type:eFtCstring, Value: email_1@domain, email_2@domain, email_3@domain, ...

Cause

The current size of the field that holds the e-mail addresses in a log is not enough to hold all the e-mail addresses.
As a result the "recipients" field sent from in.emaild.smtp process is cut off at some random location by the infrastructure (the location is not related to e-mail address structure). On a later stage, list of e-mails is sorted, and the triuncated e-mail moves to some place in the middle of this list.

Solution

Note: To view this solution you need to Sign In .