Video Screencast Help
Protect Your POS Environment Against Retail Data Breaches. Learn More.

'Statistical Sampling', 'Guaranteed Sampling' and Jounal Connector relationship?

Created: 08 Oct 2012 • Updated: 09 Oct 2012 | 6 comments
This issue has been solved. See solution.

Hi All,

According to the document

"With guaranteed sampling (the default), Compliance Accelerator captures all items for every monitored employee throughout the day. After midnight, it picks a random sample from each employee's items and adds them to the review set. If you choose guaranteed sampling, you cannot cap the number of items that Compliance Accelerator adds to the department review set.

With statistical sampling, Compliance Accelerator takes a random sample of the items that it has captured during the previous 24-hour period and adds them to the review set. This means that some employees may have fewer items captured than others with an identical monitoring percentage"

But if we using guaranteed sampling, is it mean that we dont need the install Journal Connector on EV?

Also, in the CA client, the sampling percentage is it relation to 'Statistical Sampling', 'Guaranteed Sampling'

Thanks

 

Comments 6 CommentsJump to latest comment

TonySterling's picture

You will need the Journal Connector regardless of what Sampling method you use.

As for the other question, could you tell me what screen you are looking at for sampling percentage?

Kenneth Yeung's picture

Attached the image for The Sampling percerntage in the search

also according this technote http://www.symantec.com/business/support/index?page=content&id=TECH167367&actp=search&viewlocale=en_US&searchid=1349689996815

if tblVaultSamples have more item, the search will fail, then how can reduce the item in there?

TonySterling's picture

Ok, that sampling percentage is going to apply to the specific search results so if your search results in 1000 hits and you set the sampling at 20% you will get 200 results to review, unless of course you set an absolute limit.

The technote you refer to is not for ad-hoc searches but for Random Sampling.  The tblVaultSamples table will empty nightly at the scheduled Sampling Time, which is 1 am by default. 

Kenneth Yeung's picture

The sampling in search client is not related random sampling?

Our Compliance setup  a weekly schedule search so it is equal random sampling? (that sampling percentage is different on each search), then do we used random sampling

Ad-hoc search is it mean that immediate search?

Thanks

I try to read the admin guide for CA, but seem that not many information, any document can review

TonySterling's picture

Random Sampling refers to the sampling done based on the Monitoring Policy of your departments.  CA performs this on items archived from the journal mailbox via the Journal Connector and the results are loaded into the review set nightly.

The Sampling in your screen shot is for searches that you can create and run either immediately or via a schedule.  This isn't the same as Random Sampling.

You may not have Random Sampling configured at all but are using the weekly searches to give you a Sampling of emails for the previous week.

 

SOLUTION
Kenneth Yeung's picture

Thanks, that mean we use the scheudle search is not mean the Random Sampling,