Why is Endpoint Discover Agent multiple times slower than Network Discover?

Products

• Data Loss Prevention Endpoint Discover

Issue/Introduction

Discover scan of a workstation is faster than an Agent-based scan.

Resolution

Relevant versions:  8.0 and up

A Network Discover scan of a workstation is expected to be faster than an agent-based scan due to the following:

• A server has superior processing power compared to an Endpoint
• Endpoint Discover scans are done in parallel (this is not the case for regular Discover scans)
• An Endpoint Discover scan pauses if the Endpoint agent is busy with Endpoint Prevent, because Endpoint Prevent takes priority.
• The Endpoint Discover scan pauses if the battery is low or if Vontu runs out of space to store the files/incidents. (if this happens, it will show up in the logs at the FINE level)  NOTE:  Endpoint Prevent will never pause.
• Throttling of the Endpoint agent, which makes sure the Discover scan does not affect usability of the agent machine.  There is a setting in the UI labeled Maximum average CPU usage which can be adjusted. 

When it comes to scanning a large number of workstations, the Endpoint agent has the performance advantage.