Symantec DLP Advanced Server Settings

[Huggenberger Andre]

I am looking for some input to the following Values which are causing issues if increased! Does somebody have experience changing this values??

What does this value Lexer.MaximumNumberOfTokens (actual value 12'000) What are its implications of rising to the maximum 30'000 or dependencies on other values?

What does this value EDM.MaximumNumberOfMatches ToReturn (actual setting 100) ist it possible to increase What are its implications or dependencies on other values?


cheers Andy

------------------------------


André Huggenberger
[e-mail]

IT System Engineer [phone]
e3 AG www.e3ag.ch

Binzstrasse 24 [e-mail]

CH-8045 Zürich [phone]

------------------------------

[DLP Freak]

Hello, I'm not familiar with the lexer setting but think it is similar to the EDM.MaximumNumberOfMatches ToReturn.  They both affect the memory resources needed by the detector and the length of time an object is inspected by DLP.   You will need to increase the amount of java memory allocated the more you increase these values.  The BoxMonitor.FileReaderMemory setting on the same page controls this.
First, your organisation needs to determine a threshold for match count before an incident is generated - whether the policy is using EDM, keyword match or what have you.  Ask yourselves "Do I really need to know there are 5000 matches in a document or should you generate an incident at 100 and move on to the next object?"  The incident remediation process should bring to light the actual number of matches.

See the admin guide and system requirements guide for memory calculations
​

[Huggenberger Andre]

Thanks a lot I will give you feedback about the outcome with the client about this settings If I could personally check his custom settings!

Regards Andy