Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

More aggresive agent performance tweaking options

Created: 29 Jan 2013 | 2 comments
Pavel B.'s picture
5 Agree
0 Disagree
+5 5 Votes
Login to vote

I have run through several local DLP agent tweaking to limit the performance impact on the regular and polite users who need to use a USB storage devices, CD burning or similar functionallity irregularly. But, I was not successful enough. I have lowered Detection.FILTER_TIMEOUT.int, Detection.MAX_DETECTION_TIME.int followed by Detection.MAX_FILTER_FILE_SIZE.int but generally it leads to a really incompetent scanning. Unfortunately, the Symantec DLP uses KeyView in a manner that everything or nothing can be only scanned. There is no chance for intermediate results - just excerpts - to be processed like within some competitive products. In general I see a better option to quickly scan initial kilobytes of a data instead of killing user performance by exhaustive scanning. I would like to ask if a possibility to allow also a partial (time/kB/num.files limited) extraction can be allowed before detection, so it can happen. I think slight increase of false-negatives is better than totally DoS-ing the user stations. Thank you.

Comments 2 CommentsJump to latest comment

Tariq Naik's picture

interesting thought

0
Login to vote
kishorilal1986's picture

Nice idea

0
Login to vote