Support Center > Search Results > SecureKnowledge Details
"DLP Recipients" field in DLP log contains truncated e-mail addresses
Symptoms
  • The following DLP logs appear in SmartView Tracker:

    • UserCheck section
      User Response = Pending
      UserCheck Message to User = Email was flagged as Confidential Please enter a reason for this action
      Confirmation Scope = For this rule
      
    • User Information section
      DLP Recipients = e-mail addresses are truncated at random place
      

      Example:



    • DLP Type section
      Action = Ask User
      DLP Action Reason = Rule Base
      Message to User = DLP violation occurred
      
    • Traffic section
      Destination = Mail_Server
      Service = smtp (25)
      File Direction = internal to external
      
  • Debug of in.emaild.smtp daemon (per sk60387) shows in $FWDIR/log/emaild.smtp.elg:

    CBinObjCommon::PackLogData: too long string (XXX bytes) was truncated
    CBinObjCommon::PackLogData: Field number:14, Data offset:NNN, Type:eFtCstring, Value: email_1@domain, email_2@domain, email_3@domain, ...
    
Cause

The current size of the field that holds the e-mail addresses in a log is not enough to hold all the e-mail addresses.
As a result the "recipients" field sent from in.emaild.smtp process is cut off at some random location by the infrastructure (the location is not related to e-mail address structure). On a later stage, list of e-mails is sorted, and the triuncated e-mail moves to some place in the middle of this list.


Solution
Note: To view this solution you need to Sign In .