Data Loss Prevention

Our Insight server seems to be steadily above 70% cpu utilization.  Any tips on what to look for or how to resolve?  The two processes that seem to run high are merge_rpt.exe and idxwriter.exe.  Both of those stay above 20%.

Assuming you just have one single tier server? (Mgmt, indexer and collector on same server).

You can reduce the threads used to index (idxwriter.exe) in Data Insight Servers > Server > Advancted Settings > Indexer Settings. You can also reduce the frequency, however this will impact how soon the access/scan data will appear in workspace.

You can also reduce the threads utilised to perform Audit pre-processing (Accessing events) and collection jobs in this way.

I would suggest you break out atleast the Indexer/Collector from the Management server, however you may need significantly more depending on your environment and how many filers/file servers you're monitoring.

We have index/collector servers at each site, but our mgmt server is also doing index/collector duties at our main site.  Is it a straight forward process to break that out onto another box?

I'm also noticing the hard disk space on this box quickly decreasing.  The Console (reporttruns dir) and Indexer folder eating up a lot of space.  What is the best practice to reduce these?

Yes it is a straight forward to install an additional collector or indexer, however it can be a bit time consuming to transfer each server to the new indexer/collector you setup.  You have to edit each server and then change which Indexer/Collector you are now connecting to and repeat each step.  There is not a bulk edit option to change this yet.  I know it has been requested.

Over on https://sort.veritas.com there is a Community setup just like this one and a forum dedicated to Data Insight in case you have more questions.

Yes it is a straight forward to install an additional collector or indexer, however it can be a bit time consuming to transfer each server to the new indexer/collector you setup.  You have to edit each server and then change which Indexer/Collector you are now connecting to and repeat each step.  There is not a bulk edit option to change this yet.  I know it has been requested.

Over on https://sort.veritas.com there is a Community setup just like this one and a forum dedicated to Data Insight in case you have more questions.