Spirion Sensitive Data Platform for Linux: Tips and Tricks

This article provides a compilation of relevant paths and standard cleanup steps that are useful for maintaining and troubleshooting your Spirion Linux Agents.

Note the following Linux Agent paths/locations:

Purpose

Path

Agent install staging

/tmp/SpirionPkg

Gather Data output

/tmp/Gatherdata/ (or any path you specify via --gatherdatapath)

EPS logs

/var/lib/.identityfinder/Application/{04964656e-7469-7479-2046-696e6465720}/Logs/EPS

Client/scan logs

/var/lib/.identityfinder/Application/{04964656e-7469-7479-2046-696e6465720}/Logs/SystemSearch

Settings/config

/var/lib/identityfinder/

Binaries/license

/usr/local/bin/spirion/

Standard cleanup steps (based on documented practices)

  1. Confirm no scan is running before touching any temp files:
    ps aux | grep IdentityFinderCmd | grep -v grep
    If this returns output, a scan is still active — wait for it to finish or stop EPS first.
  2. Stop EPS (if needed before cleanup):
    sudo /etc/init.d/eps stop
  3. Clear the install staging folder (safe to remove after install is complete):
    sudo rm -rf /tmp/SpirionPkg
  4. Clear Gather Data output (if you ran a gather data collection):
    sudo rm -rf /tmp/Gatherdata/
  5. Rotate/clear old scan logs (if disk space is the concern):
    sudo rm -f /var/lib/.identityfinder/Application/{04964656e-7469-7479-2046-696e6465720}/Logs/SystemSearch/*.log
    ⚠️ Run this command ONLY if you have already collected/archived the logs you need for troubleshooting.
  6. Restart EPS after cleanup:
    sudo /etc/init.d/eps restart

Important Caveat for v13.6

In 13.6, the Spirion Agent writes the PostgreSQL queue state (`search_queue_<scanId> and shipper_queue) to the local PG instance (PostgreSQL).

  • These are NOT in the temp directory (/tmp) — they live in the PG data directory managed by pgBouncer.
  • DO NOT manually delete these files; use the normal scan completion/cancellation flow to clean up queue tables.