More aggresive agent performance tweaking options
I have run through several local DLP agent tweaking to limit the performance impact on the regular and polite users who need to use a USB storage devices, CD burning or similar functionallity irregularly. But, I was not successful enough. I have lowered Detection.FILTER_TIMEOUT.int, Detection.MAX_DETECTION_TIME.int followed by Detection.MAX_FILTER_FILE_SIZE.int but generally it leads to a really incompetent scanning. Unfortunately, the Symantec DLP uses KeyView in a manner that everything or nothing can be only scanned. There is no chance for intermediate results - just excerpts - to be processed like within some competitive products. In general I see a better option to quickly scan initial kilobytes of a data instead of killing user performance by exhaustive scanning. I would like to ask if a possibility to allow also a partial (time/kB/num.files limited) extraction can be allowed before detection, so it can happen. I think slight increase of false-negatives is better than totally DoS-ing the user stations. Thank you.