Data Loss Prevention

So, I "think" in addition to the 2 processes I "thought" the DLP agent uses, there is at least one other, kvoop.exe. Is this correct? Some googling says this is a part of SMS SMTP 5, but not sure what that is and why it would be needed?

I am asking because kvoop is taking A LOT of resources that I wasn't expecting. So, if DLP does use it... is there a way to limit the resources it uses? Also, for my info, are there any more processes that I should be looking for?

Thanks!

The Kvoop.exe is the one that scans the computer when you are running Endpoint Discovery to find confidential information stored on the Endpoint system. It is a process that is part of SMS SMTP 5 and it performs out-of-process (that's what oop in kvoop stands for) True Type file identification and filtering.

Reference:

https://www-secure.symantec.com/connect/forums/what-does-kvoopexe-do-symantec-dlp

https://www-secure.symantec.com/connect/forums/what-kvoopexe

Hi, Moseng,

Kvoop.exe is the Content Extraction process of the DLP agent.

By Default We have 2 kvoop.exe processes started on Endpoint Agent for load balancing and system performance.

If you find out the kvoop.exe is taking a lot of resources, that may be releated to some kind of memory leak issue. Please use the log collection method on DLP Enforce Server to collect the log of these agents.

Please check,

https://www-secure.symantec.com/connect/forums/dlp-agent-kvoopexe-make-cpu-upto-50

https://www-secure.symantec.com/connect/forums/what-does-kvoopexe-do-symantec-dlp

https://www-secure.symantec.com/connect/forums/kvoopexe-taking-maximum-cpu-utilization

Hi Moseng,

Did u chceked above thread? It will help u to understand in better way to resolved the issue.