DLP 14.0.1, attempting to scan many large (multi-gigabyte up to >1TB) Oracle and SQL databases for SSNs. We have limited the policies for the scans to just one for now.
Throughput is currently about 3MB/minute on an Oracle database.
DLP server Hadware:
CPU: 20 single-core processors @ 2.4Ghz running in KVM virtualization, no other apps on this particular VM host.
Memory: 16GB (tried using just 8GB but was constantly 100% used; upgraded to 16GB and now 10GB is in use)
Network: 1GB ethernet, throughput is negligible, does not appear to be a factor.
DLP settings:
- MessageChain.CacheSize=32
- MessageChain.NumChains=32
- BoxMonitor.EndpointServerMemory=-Xrs -Xms300M -Xmx3072M
- BoxMonitor.RequestProcessorMemory=-Xrs -Xms600M -Xmx2048M
Symantec support rep mentioned he had seen clients hit 65-70MB/minute. Is there something else I should be looking at besides # of processor cores? Is a physical server really going to be that much faster than a dedicated, 20-core, virtual server?