frbackup on a Macintosh filling the internal drive with temporary files and cannot be deleted

book

Article ID: 171459

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent

Issue/Introduction

While using Time Machine on a Macintosh you find a lot of files fill up the internal hard drive space and cannot be deleted. The same can happen from a USB drive being ejected before DLP is able to scan the files.

Cause

DLP needs to process the files being copied. If DLP does not have time to process, DLP copies the files to this frbackup folder for process.

Environment

System Integrity Properties (SIP) may be turned on. Time Machine, external hard drive, or a USB drive may be in use.

Resolution

  1. Turn off SIP temporarily and uninstall the endpoint agent on the Macintosh (See Apple KB for more details about Mac OS and SIP). The main steps are to boot into Recovery Mode by restarting your Mac.
  2. Uninstall the Mac Agent. TECH247833
  3. Delete the necessary files in /Library/Manufacture/Endpoint Agent/frbackup
  4. Reinstall the Mac Agent.
  5. backupd application from Time Machine needs to be whitelisted in DLP. See TECH220322 or the Administration Guide for your version of DLP.