Inaccurate source file name and full

Products Endpoint Protector Discussions & Questions
,
1

  • What version are you using? (OS, client, server, etc.)

    Windows client version: 2602.1.2.0

    Windows OS: Windows 11 Pro x64 25H2

    Linux Client Version: 2602.3.3.0

    Linux OS: Linux Red Hat Enterprise Rocky Linux 9.7

    EPP server Version: Version 2602.0.1.0

  • For the scenario you’re describing, what settings/configuration do you currently have in place?

    We have web browser exit point blocked, i.e. any web uploads should be blocked except those with end-to-end encrypted channels, correct?
    We have file type as well as pre-defined and custom content set.
    We also have DPI enabled.

  • What error messages or unexpected behavior are you seeing?

    During web uploads, sometimes we get multiple logs named “web uploads”, “canonical/html”, or incorrect source path or old/stale locations upon file location change.
    Now incorrect source path - some of our files are synced to OneDrive or GoogleDrive via local client. If we change locations from our local system and upload the file, we get location of our drive where the documents are synced.

  • What have you tried so far?

    We had a session with Netwrix enabled team, where they concluded that due to syncing with cloud, the EPP fetches that parent file metadata from the drive, resulting in the logs. However, one of our customers main requirement is proper logs for auditing and this is an issue. Is there any other alternative or insight for this?

2

Hi Vishwa,

I hope you are well.

Thank you for reaching out and for the detailed information provided.

To give you some context on how this works: when EPP scans web upload traffic via DPI, only the filename is available at the time of interception. To resolve the full file path, EPP searches the endpoint’s recently accessed files list. In cases where a file with the same name has been accessed from multiple locations — for example, a local path and a cloud-synced folder — EPP may resolve to an unintended path.

To investigate this further for your specific environment, we would need the following from your side:

  1. Log samples — Exported entries showing the incorrect source path alongside the path you would expect to see.
  2. A reproducible example — Steps detailing how the upload was performed, including the file location at the time and whether a file with the same name existed elsewhere on the endpoint.
  3. Sync client details — The OneDrive or Google Drive desktop client version in use and whether folder redirection (e.g. Known Folder Move) is enabled.

This will allow us to assess the behavior accurately and determine the best path forward.

Thank you,

Cristi