You try to export a report with a large number of incidents in CSV, XML, HTML format, and you receive an error that the number of incidents exceeds the maximum limit.

15.8.x

16.0.x

Error from 16.0: The current report exceeds the maximum number of incidents that can be exported. Please filter the report so that it contains 10000 or less incidents.

By default, the system only displays up to 10,000 incidents when "Show All" is selected in the UI. This is required to export an incident report, so this limit also controls the number of incidents that can be exported.

- For 15.8.x until 16.0 MP1, in the Enforce Server, locate the file Manager.properties:

Windows: <drive>:\Program Files\Symantec\DataLossPrevention\EnforceServer\<version>\Protect\config\Manager.properties

Linux:  /opt/Symantec/DataLossPrevention/EnforceServer/<version>/Protect/config/Manager.properties

To increase the limit, change the following value in the file: 

#The maximum number of incidents that may be displayed when clicking show all on an incident list page

com.vontu.manager.maxshowallincidents = 10000 

Change the value after the = to the number of incidents that you need to export, or greater.  Note that increasing the value will impose a greater load on the Enforce server during export, and should be done with caution and tested with small increments.

After changing the value, save the Manager.properties file and restart the Enforce services in the proper order.

- For 16.0 MP2 HF1 and above, to export more than 10,000 incidents, go to:

Windows: <drive>:\Program Files\Symantec\DataLossPrevention\EnforceServer\<version>\Protect\config\Enforce.properties

Linux:  /opt/Symantec/DataLossPrevention/EnforceServer/<version>/Protect/config/Enforce.properties

And increase to value in the following setting:

# Increasing this value can adversely affect performance of the incident list API and in turn overall Enforce performance.
com.vontu.manager.restapi.incidentlist.max_incidents_threshold = 10000

Restart the Manager Service to apply the change.

16.0 and later versions, by default, only allow the Export over 10,000 incidents after you apply the 16.0 MP2 HF1 or RU1.