Video Screencast Help
As we strive to continually improve your experience on our site, please help us by taking this survey and tell us about your satisfaction level using Symantec Connect. One lucky winner will receive 500 Connect points! * Take the survey.

More aggresive agent performance tweaking options

Created: 29 Jan 2013 | 3 comments
Pavel B.'s picture
5 Agree
0 Disagree
+5 5 Votes
Login to vote

I have run through several local DLP agent tweaking to limit the performance impact on the regular and polite users who need to use a USB storage devices, CD burning or similar functionallity irregularly. But, I was not successful enough. I have lowered Detection.FILTER_TIMEOUT.int, Detection.MAX_DETECTION_TIME.int followed by Detection.MAX_FILTER_FILE_SIZE.int but generally it leads to a really incompetent scanning. Unfortunately, the Symantec DLP uses KeyView in a manner that everything or nothing can be only scanned. There is no chance for intermediate results - just excerpts - to be processed like within some competitive products. In general I see a better option to quickly scan initial kilobytes of a data instead of killing user performance by exhaustive scanning. I would like to ask if a possibility to allow also a partial (time/kB/num.files limited) extraction can be allowed before detection, so it can happen. I think slight increase of false-negatives is better than totally DoS-ing the user stations. Thank you.

Comments 3 CommentsJump to latest comment

Tariq Naik's picture

interesting thought

0
Login to vote
kishorilalWipro's picture

Nice idea

0
Login to vote
Morgado's picture

This is not already happening in the current versions?! 

Please mark as SOLUTION when your question is solved!

0
Login to vote