Archiving incidents is very slow
search cancel

Archiving incidents is very slow


Article ID: 219099


Updated On:


Data Loss Prevention


When archive incidents from the enforce console, they are archiving at a very slow rate.




This can happen if the db is heavily fragmented.


If basic log is being used then convert to secure lob as this will rebuild the tables.    Also as a workaround you can look at disabling incident correlation.

To disable the correlation processing and output for web archives, you have to disable it for the web UI of the DLP user executing the web archive: display an incident snapshot in the web UI, and click on 'Customize layout' around the upper right corner. Then select 'None' instead of 'Correlations' for 'Tab 4' on left side of the layout screen. Save your settings. Next time you create a web archive with that user, the correlations won't be processed and won't be part of the HTML archives. You can then go back to the layout configuration and restore the Correlations tab 4 whenever you want.