How to identify the owner of a report from DLP

Products

• Data Loss Prevention Enforce

Issue/Introduction

At times users may be receiving an email about a DLP report but the owner of that report is unknown. You may want to modify the schedule of this report or delete the report entirely.

Environment

DLP 14.x
DLP 15.x

Resolution

To find the owner of a report do the following:

1. Access tomcat localhost log files by browsing to 
   14.x = SymantecDLP\Protect\Logs\tomcat
   15.x = <installDrive>:\ProgramData\Symantec\DataLossPrevention\EnforceServer\15.x.00000\logs\tomcat
2. Locate the locahost.X-X-X.log that matches the date that the report was sent
3. Open the log file and search for the report name

The line in the log file will have a string similar to "The schedule <Report Name> owned by <User Name> was successfully sent."

You can now login as that user and modify the report. If logging in as that user is not an option then deleting that user will stop the report from being sent.