You are reviewing an Endpoint Incident in the DLP Enforce console.
When you click on the attachment in the incident, the .wav file that caused the incident is now replaced by a .wav.txt with contents: "The file exceeded the data retention threshold and was not retained"
This is the correct behaviour and by design.
Versions of DLP prior to 14.5 DLP would truncate files at a threshold which generally led to corrupt unreadable files in the console because very few file types are still usable post-truncation.
This behaviour was changed in version 14.5 and later to discard attachments above a specified threshold size and instead replace them with a text file of the same name with the message inside "The file exceeded the data retention threshold and was not retained".
The DLP Agent Configuration - Advanced Agent Setting named IncidentHandler.MAX_INCIDENT_FILE_SIZE.int allows you to choose a reasonable size threshold that can be supported by your network bandwidth and database storage designs, which in turn permits inclusion of attachments, without the corruption up to that pre-defined threshold size.
If the file exceeds the data retention threshold value of IncidentHandler.MAX_INCIDENT_FILE_SIZE.int the the file is discarded as mentioned above. The default value of this setting is 31457280 bytes.
To modify the threshold value follow these steps:
Login to the Enforce console and go to System > Agents > Agent Configuration page.
Select the Endpoint Agent configuration you wish to modify and apply the change to.
For version 14.x or below click on the Advanced Agent Settings tab
For version 15.x click on the Advanced Settings tab
Scroll down the page until you find the setting IncidentHandler.MAX_INCIDENT_FILE_SIZE.int
Then enter a threshold value that you require to keep files up to that threshold and discard the rest.
Click Apply Configuration.
Select the Agent Group to apply the change to and click the Update Configuration button.
At the Update Configuration prompt click OK.
Subscribing will provide email updates when this Article is updated. Login is required.