Enforce Server is running out of disk space

Products

• Data Loss Prevention Core Package

Issue/Introduction

Received a server alert that the Enforce Server was using over 90% of disk space. 

 

Environment

DLP 16.0.1

Linux OS

Cause

After upgrading to DLP 16.0.1 disk usage almost doubled.

 

Resolution

Deleted old index files and old .bad incident files from the 15.8 installation directory and gained back over 150GB of disk space.

cd /var/Symantec/DataLossPrevention/EnforceServer/15.8.00000/scan/incremental_index

du -h MONITOR_CONTROLLER 

Found several GB of old incremental indexes that were able to be removed.

cd /var/Symantec/DataLossPrevention/ServerPlaformCommon/15.8.00000

du -h incidents

Found over 150GB of old .bad incident files within the incidents folder that were able to be removed.

For more information about .bad files, refer to the following article:  What is a .bad file?

Additional Information

If this is a Windows Enforce Server, the following directory paths would be as follows:

C:\ProgramData\Symantec\DataLossPrevention\EnforceServer\15.8.00000\scan\incremental_index\MONITOR_CONTROLLER

C:\ProgramData\Symantec\DataLossPrevention\ServerPlatformCommon\15.8.00000\incidents

Another path that might have a lot of index files that could be removed:

C:\ProgramData\Symantec\DataLossPrevention\ServerPlatformCommon\15.8.00000\index

Other older version directories could be checked as well. ie 15.5, 15.7, etc.