frbackup on a Macintosh filling the internal drive with temporary files and cannot be deleted

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

While using Time Machine on a Macintosh you find a lot of files fill up the internal hard drive space and cannot be deleted. The same can happen from a USB drive being ejected before DLP is able to scan the files.

Environment

System Integrity Properties (SIP) may be turned on. Time Machine, external hard drive, or a USB drive may be in use.

Cause

DLP needs to process the files being copied. If DLP does not have time to process, DLP copies the files to this frbackup folder for process.

Resolution

There are two possible methods to resolve this issue. The first is to shutdown the agent and attempt to delete the files. If the first option doesn't work then uninstall the agent to delete the files.

Method 1: Shutdown the DLP Agent then delete the files

1. Locate the service_shutdown tool and copy it to the machine. Use chmod as needed (see source KB)
2. Run service_shutdown
3. Delete the files in /Library/Manufacture/Endpoint Agent/frbackup
4. Whitelist time machine application (backupd) as per this KB
5. Restart the machine when ready to enable DLP agent

Method 2: Uninstall the agent and clean up the files

This method is used if doing method 1 is unable to allow the files to be deleted.

1. Turn off SIP temporarily and uninstall the endpoint agent on the Macintosh (See Apple KB for more details about Mac OS and SIP). The main steps are to boot into Recovery Mode by restarting your Mac.
2. Uninstall the Mac Agent. 
3. Delete the necessary files in /Library/Manufacture/Endpoint Agent/frbackup
4. Reinstall the Mac Agent.
5. backupd application from Time Machine needs to be whitelisted in DLP. See this KB or the Administration Guide for your version of DLP.