.VEP and .SNP files are filling up the Endpoint Agent temp folder

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention

Issue/Introduction

.VEP and .SNP files are filling up the Endpoint Agent temp folder.

Environment

DLP 15.x, 16

Resolution

To address the issue, we recommend updating your agent to the latest version first. Ensure that all recent hotfixes are applied to the version of the agent you are currently using. It’s important to note that there was a specific problem with the 16.0 RU1 agent, which has been resolved in the 16.0 RU1 Hotfix 3. Keep in mind that any subsequent hotfixes are cumulative and include previous fixes, as do later versions such as 16.0 RU1 MP1.

If you are unable to update your agent, then this issue may be resolved by changing how the agent handles these temporary files. Use the following steps to address this issue:

1. From the Enforce console go to System > Agents > Agent Configuration
2. Edit the applicable Agent Configuration
3. Uncheck the local drive monitoring option.
4. Click on the Advanced Settings tab
5. Set FileSystem.ENABLE_FILE_RESTORATION.int  to 0
6. Set FileSystem.ENABLE_VEP_FILE_ELIMINATION.int to 3
7. Click Save
8. Click Apply Configuration (Do not skip this step)
9. Select the applicable Agent Group(s)
10. Click Update Configuration

Additional Information

In DLP 16 the VEP setting of 7 is no longer supported and decreases performance as it is obsolete. Please see the Advanced agent settings for DLP 16.

VEP file settings 0,1,2,3 are the only supported values for DLP 16 for ENABLE_VEP_FILE_ELIMINATION.int

DLP 16 RU1 HF3 is available to resolve the issue of .vep files not being deleted out of the temp folder.