Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

Alert Path = "Unavailable"

Created: 06 Sep 2013 | 5 comments

Hello,

we have some alerts where Alert Path = "Unavailable". What is the reason of this ?

All other alerts are ok (excepted summarized data of course)...

Thanks in advance for your help,

Regards

Operating Systems:

Comments 5 CommentsJump to latest comment

Rafeeq's picture

You should see it as summarized data

Events that are used to create a summarized data event are called compressed when the summary event is created. Those are the events that get deleted, not the summary event.

if the event is deleted then the path wont be available.(To adjust the settings that apply to compressed events in SEPM, go to Admin > Servers > Site Properties Database.)
If you look at the details of a summarized event, the File/Path section will show each folder where individual detections occurred. This is because the original events are still in the database and can be referenced by the summary event. When enough time has passed, the File/Path section no longer shows the same details. This is because the original records have been deleted based on the "Delete Compressed Events" setting. The summarized event is still a Risk Event and its deletion is governed by the "Delete Risk Events" setting.
Xtof's picture

Hello,

file has not been deleted but put in quarantine. And the report is not Summarized data but Path unavailable.

sandra.g's picture

Are they Auto-Protect detections? In my experience it means it's a file was deleted before it had a chance to write to the hard drive.

I'd check the link provided by James007, too.

Hope something helps you here. smiley

sandra

Symantec, Senior Information Developer
Enterprise Security, Mobility, and Management - Endpoint Protection

Don't forget to mark your thread as 'solved' with the answer that best helps you!

Xtof's picture

Hello,

Auto-Protect is on. Does that mean file is treated in memory ? Can it be on memory before hard drive ?

Regards