Data Loss Prevention

I am currently facing a quite vital issue here: Performance has gone down and makes the system barely usable.

We are upgrading from 11.6.3 to 14.6MP1 - All with Oracle 11g so far.
Since the upgrade from 12.0 to 14.0, the performance of the Enforce GUI has dropped dramatically:

From 2s to display an incident (I am always using the same incident to test), the times have increased to almost 2 minutes to display the incident.

No errors in the logfiles, I wish there were.

Did anybody else also encounter such a type of issue? Any help welcome.

Flutti,

Keep in mind that the mind that the minimum specs have increased when you went to 14. So you may want to increase the CPU and memory.

Also keep in mind that the issue may be the DB and someo of the query tables have not been fully loaded.

Also make sure to clear your cache on the browser.

Otherwise I would reccomend to run the DB statistics checks (Under System) to make sure the tablespaces are in good shape.

Laslty how many Events do you have, if you have over 100K this will have a major impact on queries.

As an FYI, there are some improvments in performance that are coming in 14.6 MP2 and v15.

Ronak

Hi Ronak

Thank you for the input.
The technical specs are okay, the server is basically doing nothing else than waiting. We only have one Enforce, one Oracle DB (on a central cluster) and only Endpoint Prevent. So the server is basically doing nothing.

I would def say it is a DB issue.

query tables have not been fully loaded

What do you mean with that? How can that be?
The DB is pretty full, as we have various Millions of incidents.

One main thing that really is bugging me is the fact that the whole environment with a clone of the DB has been working marvellouly prior to the upgrade.

If you have Millions of incidents, than its a DB issue. Having that many events will cause a slow down. You can try and delete a lot of the events.

The issue might really be with the DB, you may want to see if the DB reports run wihtin 5 min.

I would reccomend calling support and ask them if there is anythin you can do.. You also may want to look at the Manager.properties and see about increasing some of the memory settings

Good Luck

Ronak

Well, I absolutely do agree with you. Deleting incidents nevertheless is not an option at all.

Which keeps me only with one question left:
Why is everything running smoothly on the same DB with even more incidents and DLP 11 before upgrade?

Solved this: Had to install another license as well to speed up things.
In the end it was the incident display layout which could not be changed with the DLP Standard license (which, by the way is a shame).