Changing the incident blob externalization directory
search cancel

Changing the incident blob externalization directory


Article ID: 213477


Updated On:


Data Loss Prevention Data Loss Prevention Endpoint Suite


You want to change the incident bob externalization directory and ensure that all prior message blob files will remain accessible.


DLP 15.x


DLP uses the value (the default relative paths are initially based on the wrapper.working.dir value in the SymantecDLPManager.conf file) as the directory starting point for building the path to incident message blobs such as cracked component, cracked component marker and uncracked component. When the messages are stored and retrieved, a simple derivation method is used to find the message blob based on the message id.

For example, if the message id is 123456, the message will be stored under the starting point defined by within 4 nested subdirectories as shown below using the default starting point of incidentblobdata:

The subdirectory paths are created based on the message id, in a 19 character path that is derived by taking the message id, padding with 0s to the left until it is 19 characters long, then splitting that into into 4 sub directories of 10 characters, 3 characters, 3 characters and 3 characters. Because the subdirectory path is always derived dynamically based on message id when storing and accessing the files, you can simply change the entry point for in and then restart the IncidentPersister and Manager services.

For example, to change from the default of = ../../../incidentblobdata to another drive that has more space:

  1. Stop the IncidentPersister service.
  2. Update and set to the new path, e.g. M:/incidentblobdata
  3. Copy all the data from the previous folder to the new path.
  4. Start the IncidentPersister service.
  5. Restart the Manager service.

Additional Information

See Converting LOB incidents to External Storage in DLP currently supported versions to configure external storage.