Error "You do not have proper permissions to delete the files" while deleting agt_traffic.log file from Endpoint Protection Manager server.

Products

• Endpoint Protection

Issue/Introduction

There is lot of traffic from  Endpoint Protection Manager to Splunk and the agt_traffic.log keeps increasing in size impacting the log forwarding to Splunk consuming large disk space.

Deleting the file after stopping  Endpoint Protection Manager services results in error "You do not have proper permissions to delete the files" even with admin rights on the server. 

Environment

Release :SEP 14.3

Component : Symantec Endpoint Protection Manager

Cause

External logging is enabled in Endpoint Protection Manager and files are in use.

Resolution

1. Disable 'Transmission of Logs to a Syslog Server' from  Endpoint Protection Manager

• In the console, click Admin.
• Click Servers.
• Click the local site that you want to disable the External logging.
• Click Configure External Logging.
• On the General tab, Uncheck Enable Transmission of Logs to a Syslog Server.

2. Stop  Endpoint Protection Manager services and Splunk forwarder service

3. Delete the log file under Symantec Endpoint Protection Manager installation directory ..\Symantec Endpoint Protection Manager\data\dump

4. Restart the Symantec Endpoint Protection Manager and Splunk services

5. Enable 'Transmission of Logs to a Syslog Server' setting again

• In the console, click Admin.
• Click Servers.
• Click the local site that you want to enable the External logging.
• Click Configure External Logging.
• On the General tab, Check Enable Transmission of Logs to a Syslog Server.

Additional Information

https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/Monitoring-Reporting-and-Enforcing-Compliance/viewing-logs-v7522439-d37e464/exporting-data-to-a-syslog-server-v8442743-d15e1107.html