How to modify the Last Access Date in Discover Scan

Products

• Data Loss Prevention Network Discover

Issue/Introduction

How to verify whether the last access date is changed when running a Discover scan.

Resolution

Relevant to all versions.

For CIFS and JCIF Shares

When running a Discover scan, the scanner will touch the files, therefore resetting the last access date.  By default, Discover will restore the last access date back to the original value.

There is a setting that can change the default behavior, so that the last access date is modified. The setting is in the properties file, in one of the following locations:

DLP 15.1 and above - you should substitute the correct version for the variable in these paths:

•  /opt/Symantec/DataLossPrevention/DetectionServer/<15.x>/Protect/config
• \Program Files\Symantec\DataLossPrevention\DetectionServer\<15.x>\Protect\config

DLP 15.0:

• \SymantecDLP\Protect\config\Crawler.properties

DLP 14.6 and earlier:

• \Vontu\Protect\config\Crawler.properties

Change the following values from "true" to "false":

# Should the file system crawler reset the last accessed date of scanned files?  Mounter only
filesystemcrawler.resetlastaccessed = true

 

NOTE: This does not apply to NFS and DFS shares.
For DFS see KB article ID 219283 - DLP: Does a Discover scan of a DFS share preserve the last access date?
For NFS see KB article ID 160235 - How to setup and scan NFS drives