How to increase the max number of incidents exported with Web Archiver

Products

• Data Loss Prevention Enforce

Issue/Introduction

It is necessary to increase the maximum number of incidents that are exported using the web export archive feature.

When attempting to create a web archive that has more than 10000 incidents, a directory tree on disk is created, but immediately completes without extracting any incidents.

The following error is displayed on the "incident_list.html".

<event type="system_overview.event.level.Severe" severityID="3" id="13224515" code="2402"><time>1478613759222</time><server></server><message>Export web archive failed</message></event>

Environment

DLP Enforce Server

16.0.2

16.1

Cause

The incident list is too big to display as it contains more than 10,000 incidents.

Resolution

In 16.0 RU2 and earlier, you can change the maximum number of incidents displayed that are reported using the Web Archiver by edit the manager.properties file. This file can be found at the following locations:

Windows: <Install Drive>:\Program Files\Symantec\DataLossPrevention\EnforceServer\<version>\Protect\config

Linux: /opt/Symantec/DataLossPrevention/EnforceServer/<version>/Protect/config

The second value controls the maximum number of exported incidents, but the first value must also be changed to match the second to allow the maximum number of incidents to be retrieved by the user interface.

#The maximum number of incidents that may be displayed when clicking show all on an incident list page
com.vontu.manager.maxshowallincidents = 10000
#The maximum number of incidents allowed in a report exported using the Web Archiver
com.vontu.manager.maxwebarchiveincidents = 10000

Note: The default is 10000; you may increase the value but be aware of possible performance impacts on the Enforce server during a large export. A report consisting of several thousand incidents could take a few hours.

After applying the changes in the manager.properties file the SymantecDLPManagerService must be restarted to apply the changes.

In 16.1, add the following setting to the enforce.properties file.

#The maximum number of incidents allowed in a report exported using the Web Archiver
com.vontu.manager.maxwebarchiveincidents = 10000

In order to change the viewing of more than 10000 incidents, the first setting above must still be modified. The second setting is also required to be changed, to allow the export of more than 10000 incidents.