Changing the incident blob externalization directory

Products

• Data Loss Prevention
• Data Loss Prevention Endpoint Suite

Issue/Introduction

You want to change the incident bob externalization directory and ensure that all prior message blob files will remain accessible.

Environment

DLP 15.x

Resolution

DLP uses the com.symantec.dlp.incident.blob.externalization.dir value (the default relative paths are initially based on the wrapper.working.dir value in the SymantecDLPManager.conf file) as the directory starting point for building the path to incident message blobs such as cracked component, cracked component marker and uncracked component. When the messages are stored and retrieved, a simple derivation method is used to find the message blob based on the message id.

For example, if the message id is 123456, the message will be stored under the starting point defined by com.symantec.dlp.incident.blob.externalization.dir within 4 nested subdirectories as shown below using the default starting point of incidentblobdata:

The subdirectory paths are created based on the message id, in a 19 character path that is derived by taking the message id, padding with 0s to the left until it is 19 characters long, then splitting that into into 4 sub directories of 10 characters, 3 characters, 3 characters and 3 characters. Because the subdirectory path is always derived dynamically based on message id when storing and accessing the files, you can simply change the entry point for com.symantec.dlp.incident.blob.externalization.dir in Protect.properties and then restart the IncidentPersister and Manager services.

For example, to change from the default of com.symantec.dlp.incident.blob.externalization.dir = ../../../incidentblobdata to another drive that has more space:

1. Stop the IncidentPersister service.
2. Update Protect.properties and set com.symantec.dlp.incident.blob.externalization.dir to the new path, e.g. M:/incidentblobdata
3. Copy all the data from the previous folder to the new path.
4. Start the IncidentPersister service.
5. Restart the Manager service.

Additional Information

See Converting LOB incidents to External Storage in DLP currently supported versions to configure external storage.