Files to collect when the Data Loss Prevention (DLP) agent is missing from the management console

To collect the files:

1. If the DLP agent service is running, run "sc query dsasvc" via the command prompt.
2. Check if the agent can access the server by pinging it (i.e. ping <servername>).
3. Get the dsa.prf file under C:\windows\system32\dgagent\.
    

   You can use Windows key + R key then type C:\windows\system32\dgagent\ to open the folder.
4. Make sure that the value of link_ip found inside the ..\windows\system32\dgagent folder\dsa.pro file is the IP address of the DLP server. You have to reboot the agent service for the change to take effect. Below is an example:

   link_ip=<IP address of DLP server>
   link_port=8904
   max_queue_kbytes=100000
   usa_name_vad_on=true
   converter_dll=keyview
   disable_stop=false

5. Enable the DLP debug log:
   1. Stop the agent service by typing "sc stop dsasvc".
   2. Copy the Logger.cfg file to C:\windows\system32.
   3. Start the agent service by typing "sc start dsasvc".
   4. Collect the debug log under C:\.

      The log file's name starts with "dlpdbg".

6. Get the agent GUID value from HKLM\SOFTWARE\Provilla\AgentGuid registry.
7. Get the controller log in server from .../home/dgate/prod/controller/logs.