How can I dump the Endpoint Agent configuration for review?

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Endpoint Discover

Issue/Introduction

How can I dump the Endpoint Agent configuration for further investigation?

Environment

DLP 15.8.x / 16.0.x

Windows / Mac OSX

Resolution

Windows:

Transfer vontu_sqlite3.exe to the endpoint machine.  This tool is included with the Symantec_DLP_X.X_Agent_Win-IN package located on the Broadcom support portal (https://support.broadcom.com).

To run this tool, copy vontu_sqlite3.exe into the Endpoint Agent directory where the ks.ead file is located.  The default path for windows endpoint agents is C:\Program Files\Manufacturer\Endpoint Agent

Open a command prompt, change directory to the Endpoint Agent directory and then execute:

vontu_sqlite3 -db=<database file> [-p=<password>]

Example: 

vontu_sqlite3 -db=cg.ead -p=VontuStop

This will bring up a sql prompt from which sql commands may be executed. 

Run the following commands to dump all configuration settings to a file called cgdump.txt in the same directory.

.header on
.mode csv
.once cgdump.txt
.dump
.exit

 

Mac OSX:

Download the Symantec_DLP_XX.X_Agent_Mac-IN.zip package from the Broadcom support portal. The vontu_sqlite3 tool is included in this package. Copy the tool to a temporary folder on the Mac system. Open a terminal window on the temporary folder and run the below command:

sudo chmod 755 vontu_sqlite3

Then copy the file to /Library/Manufacturer/Endpoint\ Agent/ folder.

Open a new terminal window for the Endpoint Agent folder and run the below command:

sudo ./vontu_sqlite3 -db=cg.ead -p=<Tools password>

At the sqlite prompt, run the following commands to dump all configuration settings to a file called cgdump.txt in the same directory.

.header on
.mode csv
.once cgdump.txt
.dump
.exit

The cgdump.txt contains all of the configuration data. Provide this .txt file to support as needed.