Symantec DLP causing Chrome and FireFox to crash.

[bmee]

Hello All,

I was wondering if anyone is having the same issues as us where Chrome (69.0.3497.92) and FireFox (62) crash on DLP version 15.0.0107.01001. When it crash the DLP (EDPA) will spike the CPU to 100% and the whole computer would freeze up. We would have to hard power it off and power it back on. After power it back on, it'll work for a couple of hours then it'll crash again.

I'd removed DLP from one of our Mac and Chrome and FireFox stop crashing.

Also I installed the one of the old version of DLP (14.5) and Chrome and FireFox would work fine for a couple of days and then crash but just not as much as version 15.

any help would be appreciated

Thanks in advance.

[ocla__09]

This is a known issue that Symantec is aware of. They recommended some config changes for our DLP admins to make and so far so good, however it has been a short time since these were implemented.

[bmee]

Well, I'm glad I'm not the only one that is going crazy for a whole month now. Can you PM me what change they recommend for you to do? I would like to forward it to our security team.

Thanks

[cjames]

Our company have upgraded from DLP 14 to DLP 15 recently, and our systems, macOS Sierra 10.12.6 (Build 16G1510), are also experiencing spontaneous hanging and crashing behaviour from web browser applications primarily Chrome (versions 67.0.3396.99, 68.0.3440.106, 69.0.3497.92), Safari (version 11.1.2) and possibly also Firefox (versions 59, 60, 62 (FF issues less widely reported)).

So far we think we've ruled out Chrome Extensions and network/proxy issues as possible root causes.

This has been widespread & ongoing for us since the end of August!!!

[gmce87]

We rolled out DLP 15.0 to our systems back in March and we experienced issues where the EDPA process would randomly shoot up to 100% CPU usage and basically grind the system to a halt. In our case though, it was caused by one of the regular expressions we were trying to collect.

We had to disable our policies on a test machine and then re-enable them one-by-one, and then perform some tests to generate incidents for each policy type, within a couple of hours we'd identified which regex was causing the issue, from what I can recall it was due to the regular expression not being supported by DLP's implementation of regular expressions.

[ocla__09]

@meexiong Looks like my response to you did not get through.I am not sure what our DLP admins did, but if you log a ticket with SYmantec I am sure they can let you know.