Incident backlog on enforce server

Products

• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

Incident backlog on enforce server however incidents do not convert to .bad and enforce web console responds slow.

Cause

Sluggish response from Oracle DB server.

Slow response from Oracle DB increases incident backlog on enforce server.

Simple queries ran on DB server for e.g. DB table summary query took 15 to 20 mins to complete.

Customer was over the recommended 1 million incidents limit.

Thread: 169 WARNING [com.vontu.enforce.domainlayer.events.system.SystemEventLogger] Over 1000000 incidents currently contained in the database. Persisting over 1000000 incidents can decrease database performance.

Resolution

The OEM database configuration we provide is designed for Enforce servers that are maintaining less than a million incidents. Not keeping up with incident remediation and maintain the incident list will require additional LOB files and will slow down performance. Adjustment to the SGA memory for the Oracle database instance could improve DB performance.