Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
1479 Views 9 Replies Latest reply: Jan 29, 2014 9:55 PM by vimalnavis RSS
lawler_09 Newcomer 11 posts since
Nov 29, 2011
Currently Being Moderated

Jun 28, 2013 4:07 AM

DLP 9.3 Slowness

Hi,

 

We upgraded to 9.3 and i'm liking some of the changes it's brought like moving bypass code generation from the policy editor etc.

 

The one thing i do NOT like is moving the DLP Monitor into ePO itself.

 

I'm finding that the replacement to the dlp monitor, dlp incident manager is incredibly slow.

 

Is anyone else finding this?

 

It takes a good minute for the intial list to load, then if i click into something, and come back out again, it has to load it all again which then takes another minute.

 

I'd rather not go back to 9.2 but the slowness is making 9.3 unuseable for us.

  • iaries Newcomer 1 posts since
    Jul 9, 2013
    Currently Being Moderated
    1. Jul 9, 2013 7:06 AM (in response to lawler_09)
    Re: DLP 9.3 Slowness

    Hi,

     

    Yes we have faced with the same problem. We use ePO 4.6.6 and DLPE 9.3 (after upgrading from 9.2.2). But we have approximately 7 000 000 events on 410 000 pages. Because of this we have to wait half an hour while this dashboard loading.

  • vimalnavis McAfee SME 204 posts since
    Feb 23, 2010
    Currently Being Moderated
    2. Jul 9, 2013 9:52 AM (in response to lawler_09)
    Re: DLP 9.3 Slowness

    This is a known issue at this time. Expect a repost of 9.3 sometime this week.

  • tonyw McAfee Employee 159 posts since
    May 9, 2011
    Currently Being Moderated
    3. Jul 11, 2013 5:16 PM (in response to lawler_09)
    Re: DLP 9.3 Slowness

    Before the 9.3 refresh is released, you can contact support and reference KB78662 for a workaround to be performed.

  • warlock003 Newcomer 4 posts since
    Dec 10, 2012
    Currently Being Moderated
    4. Jul 15, 2013 2:40 PM (in response to lawler_09)
    Re: DLP 9.3 Slowness

    I had an issue with the 9.3 server being very slow to open.

    1. Make sure you database is not to large.

    2. Setup a purge for say 90 or 180 days.

    3. Uninstall DLP Management tools (make sure all browsers are closed) add-rem programs remove - reboot login to console and select dlp monitor and or incident manager and the new version will come down also make sure your client is 9.3

  • ta11 Newcomer 10 posts since
    Aug 30, 2012
    Currently Being Moderated
    5. Jan 27, 2014 6:36 AM (in response to lawler_09)
    Re: DLP 9.3 Slowness

    Now we have January 2014, upgraded DLP extention from 9.2 to 9.3.1 and still have performance issue.

    We have db with about 4 000 000 DLP events.

    Upgrade proccess was very painful, we did 2 times rollback. Finally succeeded.

    But ...

    ... global admin opens Incident Manager with about 20 sec every time you need to go to the page.

    DLP events reviewer gets error after 45 secs.

    Posted it here.

    Also waiting response from support.

     

    rgds

    Taavi

  • keithdrone Apprentice 56 posts since
    Jan 28, 2013
    Currently Being Moderated
    6. Jan 27, 2014 11:01 AM (in response to ta11)
    Re: DLP 9.3 Slowness

    First off, try clearing out some events you don't need or know are not relevant.   The 'Incident Purge' works good for this.

     

    DLP logs a lot of extra data you likely don't need, such as 'policy applied' etc.

  • ta11 Newcomer 10 posts since
    Aug 30, 2012
    Currently Being Moderated
    7. Jan 28, 2014 8:52 AM (in response to keithdrone)
    Re: DLP 9.3 Slowness

    Thnx for tip keithdrone. Yes, there are some type of events that could be purged.

    When analysing events in db I discovered that there is massive amount of events from old times when we used DLP 3.0.

    Could be I havent discovered those  before because those do not show up with ePO thread and client events, but only with DLP events (under "other" queries).

    Seems that after DLP upgrade from ver 3 to ver 9, this is changed. All the ePO purge tasks stopped to see those ...

     

    And now it seems to me that this is not possible to remove those 3.0 events with simple way ... , at least admininstrative events ...

     

    rgds

    Taavi

  • keithdrone Apprentice 56 posts since
    Jan 28, 2013
    Currently Being Moderated
    8. Jan 28, 2014 9:59 AM (in response to ta11)
    Re: DLP 9.3 Slowness

    You can create the Incident Purge tasks via the incident manager (and use the EPO server tasks to schedule them),   For 'Operational Events'  use the 'Database Administration' via the DLP Policy page (bottom left, I think).  

     

     

    If you still can't delete them, but can access them via the incident manager, try assigning labels then creating tasks to delete them based on that.  Otherwise check with support, we had a similar issue when we went from 9.1 to 9.2 then 9.2.2 now 9.3......    discovered all sorts of items we thought were 'gone'.   Took me a while to get them purged, some had to be done by treating them as 'Operational Events'.

  • vimalnavis McAfee SME 204 posts since
    Feb 23, 2010
    Currently Being Moderated
    9. Jan 29, 2014 9:55 PM (in response to ta11)
    Re: DLP 9.3 Slowness

    Work with McAfee Support. They will be able to help you get rid of all unnecessary events and / or incidents.

More Like This

  • Retrieving data ...

Bookmarked By (1)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points