How to identify the owner of a report from DLP
search cancel

How to identify the owner of a report from DLP


Article ID: 170199


Updated On:


Data Loss Prevention Enforce


At times users may be receiving an email about a DLP report but the owner of that report is unknown. You may want to modify the schedule of this report or delete the report entirely.


DLP 14.x
DLP 15.x


To find the owner of a report do the following:

  1. Access tomcat localhost log files by browsing to 
    14.x = SymantecDLP\Protect\Logs\tomcat
    15.x = <installDrive>:\ProgramData\Symantec\DataLossPrevention\EnforceServer\15.x.00000\logs\tomcat
  2. Locate the locahost.X-X-X.log that matches the date that the report was sent
  3. Open the log file and search for the report name

The line in the log file will have a string similar to "The schedule <Report Name> owned by <User Name> was successfully sent."

You can now login as that user and modify the report. If logging in as that user is not an option then deleting that user will stop the report from being sent.