Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

More aggresive agent performance tweaking options

Created: 29 Jan 2013 | 2 comments
Pavel B.'s picture
5 Agree
0 Disagree
+5 5 Votes
Login to vote

I have run through several local DLP agent tweaking to limit the performance impact on the regular and polite users who need to use a USB storage devices, CD burning or similar functionallity irregularly. But, I was not successful enough. I have lowered Detection.FILTER_TIMEOUT.int, Detection.MAX_DETECTION_TIME.int followed by Detection.MAX_FILTER_FILE_SIZE.int but generally it leads to a really incompetent scanning. Unfortunately, the Symantec DLP uses KeyView in a manner that everything or nothing can be only scanned. There is no chance for intermediate results - just excerpts - to be processed like within some competitive products. In general I see a better option to quickly scan initial kilobytes of a data instead of killing user performance by exhaustive scanning. I would like to ask if a possibility to allow also a partial (time/kB/num.files limited) extraction can be allowed before detection, so it can happen. I think slight increase of false-negatives is better than totally DoS-ing the user stations. Thank you.

Comments 2 CommentsJump to latest comment

Tariq Naik's picture

interesting thought

0
Login to vote
kishorilal1986's picture

Nice idea

0
Login to vote