Data Loss Prevention

Hello,

At a customer they have the DLP Endpoint instaled with the Default configuration.

The DLP endpoint is creating a lot of temp files as the user folder (...userName/AppData/Local/temp)

The files are numbered:

DLP0000.tmp

DLP0001.tmp

...

DLPFFFF.tmp

8440 files, all with 1kb!

And the users are complaning of slow machines.

What are thoses files?

The policy have a a File Retention responce rule.

If we manually delete the temp files the machine gets back to good performance. But not much time later the temp files are back and the performance is damage again.

Help!!!

Did you ever run an endpoint discover scan on the agent machine?

how frequently it fills in? what version of DLP is used?

Hi Guil,

Please refer below

<Uuid>.tmp     - User specific temporary directory     -Outlook and Lotus Notes attachments are saved locally on the disk so that agent could scan these files. Outlook or Lotus notes     For each scan request involved in attachment scan

https://www-secure.symantec.com/connect/forums/symantec-dlp-endpoint-os-space-issue

if still problem persist please get symantec support ticket for this as this may be bug in DLP agent.

OK.

I will try to chande the FileSystem.ENABLE_VEP_FILE_ELIMINATION.int variable to 0.

On the topic you send, the files are being stored at (C:\Program Files\Manufacturer\Endpoint Agent\temp)  and in my case they are being stored at the user folder (userName/AppData/Local/temp). Is it the same?

After the DLP agent scan the copy of the sent file it leaves a 1kb file behind?! 

How can I limit the number of thoses files? 

DLP version: 11.5

Thank you.