We recently stood up a new Symantec DLP solution. 1 Enforce Server, 1 Discover server, 2 network monitor servers, 2 Network Prevent for web servers and 2 Network Prevent for Email servers. All Windows 2008R2, running 11.6.1 and all VM except for the 2 network monitor systems. My issue is with email delays for outbound mail. We have our Exchange Edge Servers sending to DLP instead of sending direct to Postini as it was before DLP. In the past, email delivery (using email to my own gmail.com address) has been almost instantaneous and at most 1 minute or 2 max. Since DLP was installed there's a variable delay that can be close to the old normal, but can also grow to as large as 12-15 minutes.
A ticket opened with support was closed without my consent after some analysis of our logs that pointed to some errors but without enough detail to resolve and then stated "working as designed". I simply can't picture a 15 minute delay in email delivery to be acceptable.
We're not a huge shop, processing perhaps 10-15K outbound messages per day. The Prevent for Email servers are virtual, running 64bit W2008R2 with 12gb ram and 4vCPU.
What should I be looking for to troubleshoot? I can accept SOME delay - since DLP needs to look at every outbound message, but 15 minutes? Something must be configured wrong or not tuned properly.