Unable to schedule EDM indexing

book

Article ID: 159706

calendar_today

Updated On:

Products

Data Loss Prevention Enforce

Issue/Introduction

Inability to schedule indexing of an EDM file.

Resolution

Initially you can upload an EDM file to the Enforce server, but if you have it on a schedule you will need to put the CSV file into the directory on the Enforce Server:

For Windows:

\Vontu\Protect\datafiles

For Linux:

/var/Vontu/datafiles

Keep in mind that when a file (CSV) is indexed, Symantec DLP will remove the file once the index is completed. So in order for an automatic update to work (re-index weekly or other desired interval) a new copy of the file (same name) will need to be created in that directory. If there is no file there and the time interval is reached, the EDM will fail and will show in the UI as an error, although the existing EDM will not be replaced.

The remote indexer will follow the exact same process.  The only difference is that it will be indexed on another server, and you will still need to have the CSV file replaced prior to the scheduled index. Once the index is created ON the remote indexer, it will copy the INDEX files to the Enforce server. It will not copy the CSV over, just the created Indexed files. (Think of an Enforce server that ONLY creates indexes. This is to reduce CPU usage on the actual Enforce server and for security issues with the CSV data leaving a specific DMZ or subnet)

Example:
xxxx has a one-way, secure copy (SFTP) that runs every Saturday night. Note - the destination directory has EFS encryption enabled. Then an automated script runs that does 3 things - copies the file to the datafiles directory, reformats the file so it's compatible with Symantec DLP, and deletes the source file in the destination directory. The automated index process kicks off Sunday morning. Indexing takes approximately 6 hours to complete. An email alert is sent indicating that the index completed successfully.