Manual changes to any logging.properties file on Enforce or Detection servers are ignored

Products

• Data Loss Prevention Network Monitor and Prevent for Email and Web

Issue/Introduction

You are trying to increase the sensitivity of the logging, either on Enforce or Detection servers by manually editing the appropriate logging.properties files, eg:

• MonitorControllerLogging.properties
• IncidentPersisterLogging.properties
• FileReaderLogging.properties
• etc

Even after restarting the appropriate service however, the changes made in the *Logging.properties file are ignored. Only INFO, WARNING and SEVERE level log messages continue to appear in the log file.

Environment

Release : 15.x, 16.x

Cause

The logging level has, at some point in the past, been set from the Enforce console from the System | Servers and Detectors | Logs menu by selecting the Configuration tab and choosing 'Restore Defaults' from the Diagnostic Logging Setting drop-down menu.

Resolution

1. Locate the relevant file path:

Enforce Server: <Drive>\ProgramData\Symantec\DataLossPrevention\EnforceServer\<Version>\LoggingConfigurationOverwrite

Detection Server: <Drive>\ProgramData\Symantec\DataLossPrevention\DetectionServer\<Version>\LoggingConfigurationOverwrite

2. Delete the LoggingConfigurationOverwrite folder and its contents
3. Restart the SymantecDLP service(s)

You can now make manual changes to the logging.properties files you need and they will be active after the corresponding DLP service has been restarted.