Improve the DLP Endpoint Agent Performance

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

• Symantec Data Loss Prevention (DLP) Endpoint Agent is performing slowing or Endpoint Agent is slowing host machine down.
• What can be checked to ensure the optimal performance of the host machine and the Endpoint Agent?

Cause

The DLP Endpoint Agent, similar to Anti-virus, or other hooking applications, involves itself in many processes on the machine. It is expected to see some slowness in the Agent and host machine. This will increase and decrease based on the scope of what the Agent Configuration is and a few other items to be addressed in this article. 

Resolution

Items to ensure optimal performance: 

1. Ensure System Requirements of the host machine have been met or exceeded. See the bottom of the following article for links: Endpoint computer requirements for the Symantec DLP Agent (broadcom.com)
2. Try rebooting the machine to ensure that issues are not related to that one login session. 
3. Ensure that your Anti-virus is whitelisted in the DLP Agent Configuration by following: How to whitelist or exclude an application from DLP Endpoint Agents
4. Ensure the DLP Agent is whitelisted in Anti-virus according to Best Practice: Endpoint Agents with Antivirus Protection
5. Whitelist other applications not to monitor, particularly other active security applications and/or Backup and Recovery applications at the company discretion. Sometimes other non-performance issues can warrant whitelisting of an application. In the case of, "frbackup on a Macintosh filling the internal drive with temporary files and cannot be deleted". 
6. See if there any mem/crash dumps on the agent. Supply these too Symantec Support if they are present. 
7. Follow Best Practices with policies 
   1. Policy matrix information: Best Practice: DLP Policy Exception Count for Endpoints (broadcom.com)
   2. EDM and IDM information: DLP Best practices for using Data and Document profiles (broadcom.com)