Included in the documentation that can be downloaded from FileConnect is a guide titled "DLP Network Sizing Guide" or something similar.  It includes the information you need to be able to size and configure a Network Monitor Server

sorry misunderstood your questio

Hi david,

 First you have to define what will be your criteria to follow your DLP performance/capacity. (On my side i dont like CPU or mem as indicator lot of other factors can impact solution performance or capacity)

For a french customer, i used to perform some xml export of incident and in this export you have some timer (detection date / creation date / send date). So like that i was able to monitor how long it takes between user sending email and monitor detect it, and then how long it takes betwwen detection and creation of incident in enforce/DB. So i can check when these durations goes over a "normal" threshold (this has to be defined based on your infra based on some measure you will perform when everything seems to work fine) and expect some analysis or improvement of system.

I am sure there is some other way to do it but i hope it helps you.

 regards.