Archiving incidents is very slow

Products

• Data Loss Prevention

Issue/Introduction

When archive incidents from the enforce console, they are archiving at a very slow rate.

 

 

Cause

This can happen if the db is heavily fragmented.

Resolution

If basic log is being used then convert to secure lob as this will rebuild the tables.    Also as a workaround you can look at disabling incident correlation.

To disable the correlation processing and output for web archives, you have to disable it for the web UI of the DLP user executing the web archive: display an incident snapshot in the web UI, and click on 'Customize layout' around the upper right corner. Then select 'None' instead of 'Correlations' for 'Tab 4' on left side of the layout screen. Save your settings. Next time you create a web archive with that user, the correlations won't be processed and won't be part of the HTML archives. You can then go back to the layout configuration and restore the Correlations tab 4 whenever you want.