ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Why is Endpoint Discover Agent multiple times slower than Network Discover?

book

Article ID: 159785

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Discover

Issue/Introduction

Discover scan of a workstation is faster than an Agent-based scan.

Resolution

Relevant versions:  8.0 and up

A Network Discover scan of a workstation is expected to be faster than an agent-based scan due to the following:

  • A server has superior processing power compared to an Endpoint
  • Endpoint Discover scans are done in parallel (this is not the case for regular Discover scans)
  • An Endpoint Discover scan pauses if the Endpoint agent is busy with Endpoint Prevent, because Endpoint Prevent takes priority.
  • The Endpoint Discover scan pauses if the battery is low or if Vontu runs out of space to store the files/incidents. (if this happens, it will show up in the logs at the FINE level)  NOTE:  Endpoint Prevent will never pause.
  • Throttling of the Endpoint agent, which makes sure the Discover scan does not affect usability of the agent machine.  There is a setting in the UI labeled Maximum average CPU usage which can be adjusted. 

When it comes to scanning a large number of workstations, the Endpoint agent has the performance advantage.

 


Powered by Wolken Software