Increase the number of incidents exported as CSV, XML, HTML

Products

• Data Loss Prevention Enforce

Issue/Introduction

You try to export a report with a large number of incidents in CSV, XML, HTML format, and you receive an error that the number of incidents exceeds the maximum limit.

Environment

15.8.x

16.0.x

Cause

Error from 16.0: The current report exceeds the maximum number of incidents that can be exported. Please filter the report so that it contains 10000 or less incidents.

Resolution

By default, the system only displays up to 10,000 incidents when "Show All" is selected in the UI. This is required to export an incident report, so this limit also controls the number of incidents that can be exported.

- For 15.8 in the Enforce Server, locate the file Manager.properties:

Windows: <drive>:\Program Files\Symantec\DataLossPrevention\EnforceServer\<version>\Protect\config\Manager.properties

Linux:  /opt/Symantec/DataLossPrevention/EnforceServer/<version>/Protect/config/Manager.properties

To increase the limit, change the following value in the file: 

#The maximum number of incidents that may be displayed when clicking show all on an incident list page

com.vontu.manager.maxshowallincidents = 10000 

Change the value after the = to the number of incidents that you need to export, or greater.  Note that increasing the value will impose a greater load on the Enforce server during export, and should be done with caution and tested with small increments.

After changing the value, save the Manager.properties file and restart the Enforce services in the proper order.

- For 16.0 MP2 HF1 and above, to export more than 10,000 incidents, go to:

Windows: <drive>:\Program Files\Symantec\DataLossPrevention\EnforceServer\<version>\Protect\config\Enforce.properties

Linux:  /opt/Symantec/DataLossPrevention/EnforceServer/<version>/Protect/config/Enforce.properties

And increase to value in the following setting:

# Increasing this value can adversely affect performance of the incident list API and in turn overall Enforce performance.
com.vontu.manager.restapi.incidentlist.max_incidents_threshold = 10000

Restart the Manager Service to apply the change.

Additional Information

In 16.0, 16.0MP1 and 16.0MP2 increasing the value in com.vontu.manager.maxshowallincidents will not work. This can be changed through second settings mentioned in this article starting from 16.0 MP2 HF1.