Large disk usage under\data\dump filled with PolicyOverride_*.xml files

Products

• Endpoint Protection

Issue/Introduction

The Symantec Endpoint Protection Manager generates many files under the C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Data\dump

These files consume a large amount of disk space.

Environment

Symantec Endpoint Protection Manager

Cause

The xml files get generated as part of a feature called "Dumping the policy to disk when it changes"

This option is automatically enabled when ”Audit Log” + “Export Logs to a Dump File” options are enabled

 

 

Resolution

XMLs file are for pure Audit reasons, we have added the option for admins to seek more clarity on what changed in the Policy.

SEPM audit logs will tell only which policy changed and when, having a policy copy before change exported in an xml format will allow to see what the policy before the change was and offers to compare with the latest policy version on the SEPM.

In order to turn off creation of the xml files we recommend either disabling Audit log or unchecking Export Logs to a Dump File.

Additionally, you can limit the dumping of records by specifying i.e 10 entries for Limit Dump File records option and setting Audit Log Limit to the desired value.

Note: Deleting the existing XML files will not have any impact on Syslog logging process.