Modify the Last Access Date in Discover Scan

Products

• Data Loss Prevention Network Discover
• Data Loss Prevention

Issue/Introduction

How to modify the last access date when running a Network Discover scan.

Resolution

Relevant to all versions.

For CIFS and JCIF Shares

When running a Discover scan, the scanner will touch the files, therefore resetting the last access date.  By default, Discover will restore the last access date back to the original value.

There is a setting that can change the default behavior, so that the last access date is modified. The setting is in the Crawler.properties file.

DLP 15.1 and above - you should substitute the correct version for the variable in these paths:

•  /opt/Symantec/DataLossPrevention/DetectionServer/<version>/Protect/config
• \Program Files\Symantec\DataLossPrevention\DetectionServer\<version>\Protect\config

 

If you do not want to restore the last access date back to the original value, change the following value from "true" to "false":

# Should the file system crawler reset the last accessed date of scanned files?  Mounter only
filesystemcrawler.resetlastaccessed = true

 

NOTE: This does not apply to NFS and DFS shares.
For DFS see KB article ID 219283 - DLP: Does a Discover scan of a DFS share preserve the last access date?

Additional Information

The Crawler.properties file location in previous versions.

DLP 15.0:

• \SymantecDLP\Protect\config\Crawler.properties

DLP 14.6 and earlier:

• \Vontu\Protect\config\Crawler.properties