Delete old DLP incidents to reduce the Oracle database size

Products

• Data Loss Prevention Enforce
• Data Loss Prevention

Issue/Introduction

The database for Symantec Data Loss Prevention (DLP) does not automatically delete incidents, and continues to grow in size over the life of the deployment.

Resolution

Once the data retention period has elapsed for your security policy, you can delete the old incidents. This helps free space in the database and improve system performance.

1. Log in to the DLP Enforce console.
2. Click the Incidents tab, and go to Incidents All.
3. Choose the appropriate date range to list old incidents. You may customize them in the Filter section; ensure the Status is correct.
4. Click Apply, and confirm the resulting list matches your intended results.
5. Manually select the incidents to delete, or click Select All. Then, under the More options, choose Delete Incidents and confirm the delete options:
   
6. The incidents are now marked for removal, and will be removed when the daily task for deletion executes.
7. To remove the incidents immediately, go to the System tab > Incident Deleter > Delete Incidents You will see all the Incidents in the queue that need to be deleted. You may then schedule a deletion time and start deletion.

WARNING: Deleting incidents from the Oracle database is permanent, and cannot be reversed.

Additional Information

See Deleting Incidents from the documentation for more information.

Reduce the Oracle database size for DLP Enforce

Deleting incidents will not necessarily reduce the LOB tablespace sizes.

• Multiple incidents may be associated with the same message.
• Message components related to incidents are stored once and referenced within the database by each incident.
• Deletions by date across all policy can improve the results unless incidents are marked hidden, not able to be deleted by a role used for doing so, etc.

Deleting incidents will not reduce the physical size nor watermark value of the database footprint where SecureFile is in use.

• SecureFile does not resize when deletion occurs, but any space within a dbf can be reused.
• The watermark will remain the same until resizing is done manually using an export/resize/import process of reclamation.

For more information on the topic of Oracle Database and LOB space https://docs.oracle.com/database/121/ADLOB/adlob_intro.htm#ADLOB45114