Grid scanning slower than a single server discover scan.

book

Article ID: 171413

calendar_today

Updated On:

Products

Data Loss Prevention Network Discover

Issue/Introduction

When setting up a Grid scan with a two servers. Scan performance is less than that of a single server detection scan without utilizing grid scanning.

Cause



Please refer to the image above.  As we can see the Grid-Leader has a very different job than the other servers in the grid scan.

Where a single server discover scan, the same server does all the crawling and scanning itself, in a grid scan, the ‘Leader’ does all of the crawling, queues the detection requests, and forwards those detection requests to the remaining discover servers in the grid.

 

Because of this, utilizing just 2 servers in a GRID scan is not recommended as this is simply adding complexity to the scan, whilst a single server is still ultimately responsible for the more technically expensive ‘detection’ tasks. Thus only adding complexity to the overall process.

 

Resolution

Once 3 or more servers are within the GRID, we can start to see performance improvements, as more than 1 server will be performing the actual detection tasks.

Attachments