Best Practices regarding the "MessageChain.NumChains" setting in the Advanced Server settings

Products

• Data Loss Prevention

Issue/Introduction

When troubleshooting performance issues (especially those related to the File Reader), the "MessageChain.NumChains" setting may need to be looked into.

Environment

DLP (two or three tier setups)

Cause

The "MessageChain.NumChains" setting is used to configure the amount of 'Message Chains' that the File Reader can open up simultaneously. In order to prevent problems with the File Reader, it is important to configure this setting in harmony with the amount of CPU cores that exist on a detection server.

Resolution

Our current recommendation (in almost all cases) is that the amount of message chains should be set to equal the amount of CPU cores on the server. If these settings are set too high in relationship to actual system resources, and a trigger event occurs, the File Reader will attempt to open up more message chains than it's CPU is able to handle. This can lead to general resource issues on the server & a variety of File Reader problems. In more severe cases, this can lead to an outright File Reader failure and the inability to restart the File Reader through normal methods. (The only potential exception to this recommendation is when a Hyperthreaded CPU is being used in conjunction with Web Prevent - due to a unique ability of Web Prevent to be able to take advantage of the hyperthreading feature ... in this specific scenario, the setting can be 2x the CPU ... but in all other scenarios, this is not recommended).

For example:
8 Core CPU: MessageChain.NumChains = 8
16 Core CPU: MessageChain.NumChains = 16
32 Core CPU: MessageChain.NumChains = 32

NOTE: The default setting of "8" on most detection servers (and the standard recommended setting in the DLP Admin Guide) is based off of testing that was conducted with a detection server with an 8 core CPU.

Another important thing to note (in relationship to preventing a queue from building up) is that the "MessageChain.CacheSize" setting should equal the "MessageChain.NumChains" setting. By default, these two settings will match up automatically ... however it is a good idea to double check this additional setting if making any adjustments to the MessageChain.NumChains setting (or if there is a possibility that either of these settings may have been adjusted in the past).