Manually deleting fingerprinting classifiers

If the crawler is unresponsive for any reason when administrators delete a fingerprinting classifier from the management server, the crawler is not alerted that the classifier has been deleted. When the crawler becomes responsive, it continues to run the fingerprinting scan as scheduled and consume unnecessary resources.

To avoid these repercussions, manually delete the classifier from its associated crawler.

The Forcepoint Security Manager displays a warning in this situation, and asks if you want to continue. If so, manually delete the classifier as follows:

1. Identify the ID of the job to delete in one of two ways:
   • View the Forcepoint DLP System Log (Main > Logs > System Log) and search for the entry stating the classifier was deleted. For example:

     The classifier Fingerprint_Name ID 8e76b07c-e8e5-43b7- b991-9fc2e8da8793 was deleted from the management server, but not from the crawler, Crawler_Name 10.201.33.1.

   • Log onto the crawler machine associated with the discovery task.
     1. Switch to the %DSS_HOME%/DiscoveryJobs folder.

        %DSS_HOME% is the Forcepoint DLP installation folder.

     2. Search for the relevant classifier and ID by opening each job, one at a time, and examining the first line of its definition.xml file.

        For example, the first line of one file might show:

        <job type="fingerprinting" id="3178b4f9-96fe-4554- ad1d-eaa29fa23374" name="ora3" altID="168476">

        If the task was named “ora3”, the ID is 3178b4f9-96fe-4554-ad1d- eaa29fa23374.

2. Delete the job:
   1. On the crawler machine identified above, switch to the %DSS_HOME%/ packages/Services folder.

      %DSS_HOME% is the Forcepoint DLP installation folder.

   2. Run the following command:

      Python WorkSchedulerWebServiceClient.pyc -o deleteJob -j #jobId#

      Here, jobID is the ID number identified in step 1.