Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Setting the maximum forensic data upload size of Apex One to 100MB

    • Updated:
    • 25 Nov 2020
    • Product/Version:
    • Apex One 2019
    • Platform:
Summary

Since Apex One patch 4 build 9113, DLP forensic data (from CD/DVD, USB, and SMB channel) maximum size was expanded to 128MB. However, it cannot be downloaded in Apex Central because of IIS and PHP limitation.

This article explains how to adjust the server settings on Apex One and Apex Central to lift the limitation.

Details
Public

To increase the maximum upload size for forensic data, do the following:

 
Before proceeding, make sure that you are running Apex One on-premise patch 4 build 9113 or later.
 
  1. Open command prompt with administrator privilege on Apex One server.
  2. Switch the working directory to {Apex One Server installation folder}\PCCSRV.
  3. Execute the following commands:
    SVRSVCSETUP -SF_ConfigDLPForensic UploadForensicDataSizeLimitInMb 150
    SVRSVCSETUP -SF_ConfigDLPForensic RejectDownloadOnFileSizeInMb 150
    SVRSVCSETUP -SF_ConfigDLPForensic maxAllowedContentLength 200000000
    SVRSVCSETUP -SF_ConfigDLPForensic uploadReadAheadSize 150000000
    SVRSVCSETUP -SF_QueryDLPForensic

Optionally, it is recommended to further configure the agent behavior. This is to avoid having too many connections with huge DLP forensic data upload, which can impact server capacity. Perform the following configuration:

  1. Open {Apex One Server installation folder}\PCCSRV\ofcscan.ini using a text editor.
  2. Go to the [Global Setting] section, and add the following keys:
    EnableConcurrentForensicUploadControl=1
    ConcurrentForensicUploadControlMinTriggerSizeInMB=20
  3. Open {Apex One Server installation folder}\PCCSRV\Private\vdi.ini using a text editor.
  4. Search for the [TaskController] section, and Add the following keys: Controller_04_MaxRunningSeconds=600
    Controller_04_MaxConcurrentGuests=10
    Controller_04_BaseWaitingTime=10
    Controller_04_MaxWaitingTime=300
    Controller_04_TaskName=DLPForensicUploadSecure
    Controller_04_SingleVirtualHostOnly=1
  5. Login to the Apex One web console, the go to Agents > Global Settings.
  6. Click Save to deploy this setting to agents.

Since Apex One server will send DLP forensic data to Apex Central server, it is necessary to change IIS and PHP settings on Apex Central server to accept large files from Apex One. Do the steps below:

  1. Open IIS Manager on Apex Central server.
  2. Select Apex Central web site. By default it is the "Default Web Site".
  3. Double click Request Filtering.
  4. Click Rules tab and click Edit Feature Settings on right panel.
  5. Change Maximum allowed content length (Bytes) to 1024000000.
  6. Open {Apex Central installation folder}\PHP\PHP.ini with text editor.
  7. Find "Memory_limit" and "Post_max_size" and change it as following:
    Memory_limit=1024M
    Post_max_size=2000M
Premium
Internal
Partner
Rating:
Category:
Configure
Solution Id:
000282727
Feedback
Did this article help you?

Thank you for your feedback!


*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.