Data Center Security (DCS)RTFIM module is unable to report file difference due to file size limit

Products

• Data Center Security Server Advanced

Issue/Introduction

The DCS Intrusion Detection RTFIM policy was applied to the DCS Agent to monitor custom files and report the file changes. 

After applying the policy the following error event was reported in DCS Console

FWC_0023:  File too big to perform diff (135 Kb > 100 Kb limit)

Environment

Windows OS

Cause

This behavior is by design; there is a limit applied to the file size to report file differences. 

 

Resolution

Changing the default limit should be tested, and it is not recommended to set the maximum diff limit, but to increase it gradually as required 

To increase the diff limit please follow the steps below:

1. Stop DCS Agent services

sisservicectrl stop sisipsservice

sisservicectrl stop sisidsservice

sisservicectrl stop sisipsutil

2. Edit and uncomment File Collector Diff File Size Limit= parameter and modify as required (please see example below)

3. Save the changes

4. Start DCS Agent services

sisservicectrl start sisipsservice

sisservicectrl start sisidsservice

sisservicectrl start sisipsutil