EMEA Data Loss Prevention User Group

 View Only

  • 1.  DLP agent 11.6.3 again leaving many files in TEMPs?

    Posted Sep 17, 2013 04:48 AM

    Hi,

    After upgrade of DLP agent to 11.6.3, I have noticed again many DLP* files in various TEMP folders. (I am running on Windows 7 32 bits.) Is it common behavior seen also for other customers and users?

    (I do not want to upgrade to 12.0 becasue it does not contain important fixies from 11.6.3 yet.)

    Thank you and Best Regards,

    Pavel

     



  • 2.  RE: DLP agent 11.6.3 again leaving many files in TEMPs?

    Broadcom Employee
    Posted Sep 17, 2013 09:04 AM
    We implemented such kind of upgrade of the DLP agent, but, didn't get any issues. Could you provide more information?


  • 3.  RE: DLP agent 11.6.3 again leaving many files in TEMPs?

    Posted Sep 18, 2013 05:02 AM

    Hi,

    I am runnig DLP 11.6.3 agent on Windows 7, EN, 32 bit.

    The files are generated inside two of the user-profile's TEMP directories, an example is:

    c:\Users\behalp\AppData\Local\Temp\DLP3411.tmp
    c:\Users\behalp\AppData\Local\Temp\DLP2E2A.tmp

    c:\Users\behalp\AppData\Local\Temp\Low\DLPE9B5.tmp
    c:\Users\behalp\AppData\Local\Temp\Low\DLPE775.tmp

    There are many of them, it counts in hundredths, with the hex-number part of name changing.

    All the files are small in size, starting from 50 to 731 bytes. Their content is binary, starting with hex "3D FA 17 46 A4"

    I have configured policies of type EDM (1) and DCM (4), all with DGM exclusion rule in place to be enabled on the desktops, on the following channels: Removable Storage; CD/DVD; IE(HTTPS); Firefox(HTTPS); Application File Access (with some custom applications on file-read event).

    The files are not locked, and can be simply deleted.

    I am unable to confirm, that it is 100% related to the DLP, but it looks like. Previously, I was running 11.6.1 without such issues.

    In case it is, I can open also a support case.

    Regards,

    Pavel

     



  • 4.  RE: DLP agent 11.6.3 again leaving many files in TEMPs?

    Posted Oct 18, 2013 10:12 AM

    Hi,

    finally I have realized, that it is an issue. There is a limit of 65.500+ files within NTFS directory.

    I have shut down all agents, going to clean up all temps. And, I will open se service call.

    Rgds,

    Pavel



  • 5.  RE: DLP agent 11.6.3 again leaving many files in TEMPs?

    Posted Oct 23, 2013 08:06 AM

    Hi Pavel,

    The files you have mentioned are of DLP

    name/extension:  <Uuid>.tmp

    Location: User specific temporary directory

     Rationale: Outlook and Lotus Notes attachments are saved locally on the disk so that agent could scan these files.

    Frequency: For each scan request involved in attachment scan

     

    Request you to either modify the policy or wait till the scan gets completed once.

     

     



  • 6.  RE: DLP agent 11.6.3 again leaving many files in TEMPs?

    Posted Oct 23, 2013 09:06 AM

    Hi,

    I am not using scanning. It is erroneous feature of standard enforcement/monitoring. Which is wrong.

    Best Regards,

    Pavel