How to increase the max number of incidents exported with Web Archiver

Products

• Data Loss Prevention Enforce

Issue/Introduction

It is necessary to increase the maximum number of incidents that are exported using the web export archive feature.

When attempting to create a web archive that has more than 10000 incidents, a directory tree on disk is created, but immediately completes without extracting any incidents.

Cause

The following error is displayed on the "incident_list.html".

The incident list is too big to display as it contains more than 10,000 incidents.

<event type="system_overview.event.level.Severe" severityID="3" id="13224515" code="2402"><time>1478613759222</time><server></server><message>Export web archive failed</message></event>

Resolution

You can change the maximum number of incidents displayed that are reported using the Web Archiver by edit the manager.properties file. This file can be found at the following locations:

Windows: <Install Drive>:\Program Files\Symantec\DataLossPrevention\EnforceServer\<version>\Protect\config

Linux: /opt/Symantec/DataLossPrevention/EnforceServer/<version>/Protect/config

The second value controls the maximum number of exported incidents, but the first value must also be changed to match the second to allow the maximum number of incidents to be retrieved by the user interface.

#The maximum number of incidents that may be displayed when clicking show all on an incident list page
com.vontu.manager.maxshowallincidents = 10000
#The maximum number of incidents allowed in a report exported using the Web Archiver
com.vontu.manager.maxwebarchiveincidents = 10000

Note: The default is 10000; you may increase the value but be aware of possible performance impacts on the Enforce server during a large export. A report consisting of several thousand incidents could take a few hours.

After applying the changes in the manager.properties file the SymantecDLPManagerService must be restarted to apply the changes.