DLP Incident query is extremely slow

[marios]

Hi to all,

We are experiencing an extremely slow performance while generating DLP incident queries the last couple of days.

The behaviour of our ePO 4.6 server is normal and all other functions including reporting/querying are working properly.

Just to note that we have recently shrunk the db in order to save some space on the server's disk.

The set-up is:

Windows 2008 R2 (on vmware)

ePo 4.6

SQL Server 2008 R2 .

Do you have any ideas how can I resolve the issue?

Thanks

Marios

[mischaboender]

I don't know how to resolve it, but I do know that shrinking the DB can impact the performance.

Shrink Database and why it is NOT recommended: 
Shrinking the ePO database should be avoided as much as possible. Shrinking a production SQL Server database would introduce logical fragmentation (physical order of the pages in the leaf level of an Index is not the same as the logical order of the pages). Effectively, the disk head has to go back and forth in reading the pages, thus performing more I/O operations and degrading performance.
Source: https://kc.mcafee.com/corporate/index?page=content&id=KB67184

[marios]

Thanks for your reply, but I have already read this document (unfortunately after I shrunk the DB).

regards,

Marios

[JoeBidgood · Accepted solution]

I would check the index fragmentation on the database and, if necessary, rebuild or reorganise the indexes. This can have a massive effect on database performance.

HTH -

Joe

[marios]

I rebuilt the indexes of DLP tables and problem resolved.

Thanks !!!!

[JoeBidgood]

Good to hear

If you haven't already done so, I would strongly recommend including the indexes in your regular database maintenance plan - this way it should be looked after automatically for you.

Regards -

Joe

[marios]

Yes I ave already created a maintenance plan to rebuild indexes

thanks for your reply

[mischaboender]

Here's some info on "Reorganizing and Rebuilding Indexes" on SQL 2008 R2: http://technet.microsoft.com/en-us/library/ms189858(v=sql.105).aspx