Other factors that affect the performance of Forcepoint reporting

Administering Forcepoint Databases | Web, Data, and Email Solutions | 8-June-2020

Applies to:

In this topic

Forcepoint Web Security and Forcepoint URL Filtering, v8.5.x

Forcepoint DLP, v8.5.1, v8.6.x, v8.7.x

Forcepoint Email Security, v8.5.x

Forcepoint appliances, v8.5.x

Factors affecting Web reporting performance

Factors affecting Email reporting performance

Factors affecting Data reporting performance

Factors affecting Web reporting performance

Users' web browsing behavior

Web browsing behavior varies widely from organization to organization. Periodically review your database performance, your reporting needs, and the actual data in the database so you can identify ways to reduce the demands on your reporting system.

Selective logging

Forcepoint Web Security and Forcepoint URL Filtering allow you to reduce the demands on your reporting system by not logging traffic to websites in selected categories. For example, online retailers might disable logging for Shopping categories. This can result in a large reduction in the amount of data that has to be stored and managed.

For information on configuring selective logging, refer to "Configuring how requests are logged" in the Administrator Help for your web protection solution.

Use of Detail Reports over long time periods

Reports of web browsing activity over long time periods (weeks and/or months) require much more memory, processor time, and disk I/O to generate. For better performance, run summary reports across long time periods on a regular schedule, then use detail reports only for investigating specific users in shorter time periods. If you have business requirements that demand generating detail reports across a large time window, you can:

Schedule the reports to run during low-activity periods in your network.

Invest in more hardware resources for your reporting system.

Number of scheduled reports or number of delegated reporting administrators

If you have several delegated administrators that use reporting each day or create several scheduled reports to run each night, this can degrade the performance of your reporting tools. If you meet these usage profiles, consider investing in more hardware resources for your reporting system: more RAM, faster disks, faster CPUs, and higher-end versions of SQL Server and Windows that support more hardware.

Geographical location of users

If you have users distributed among multiple physical locations and your business does not require unified reporting across all users, consider deploying separate Log Server and Log Database instances in each location.

Calculation of Internet browse time

By default, a database job calculates Internet browse time at 2 a.m. for the previous day's activity. This is a memory-, processor-, and disk I/O-intensive activity. If you don't use Internet browse time to manage your users' web browsing activity, consider disabling Internet browse time to improve the performance of your reporting system.

For information on configuring Internet browse time, refer to "Configuring Internet browse time options" in the Administrator Help for your web protection solution.

Partitioning

The Log Database is segmented into partitions for easier data management. Depending on the time period covered by a report, Forcepoint software may need to query multiple partitions. This may make report generation less efficient.

By default, a new Log Database partition is created when the current partition size reaches 5 GB (3 GB if you use SQL Server Express). (With Standard and Enterprise versions of SQL Server, you can also configure the Log Database to roll over at a specific time interval.)

Review the size and content of the partitions in the database after your system has been installed and receiving data for a few days, then tune the partitioning configuration (rollover size or time period) accordingly.

For information on managing partitions, refer to "Configuring database partition options" in the Administrator Help for your web protection solution.


	Note Due to Microsoft SQL Server restrictions, you are limited to 70 active log database partitions. You may retain more than 70 partitions, but only 70 may be active (enabled) at any one time.

Hybrid service users

The sizing guidelines in this document include logs generated by users managed by the Forcepoint Web Security hybrid service (Hybrid Module). When sizing your reporting system, do not forget to include those users.

Configuration options that affect Log Database sizing, including selective logging, logging visits, and full URL logging, also apply to hybrid log records, so no special consideration needs to be made for those users.

Factors affecting Email reporting performance

Number of scheduled or custom presentation reports

If you create a large number of scheduled reports to run each night (more than 10) or use a large number of custom presentation reports (more than 10) each day, this can affect reporting performance. In particular, the following 3 reports place high demands on system resources:

Top n External Recipients by Message Volume

Top n External Recipients by Message Size

Top n Data Loss Prevention Violations by Volume

If you meet these usage profiles, consider investing in more hardware resources for your reporting system: more RAM, faster disks, faster CPUs, and higher-end versions of SQL Server and Windows that support more hardware.

Partitioning

The Email Log Database is segmented into partitions for easier data management. Depending on the time period covered by a report, your reporting tools may need to query multiple partitions. Running such reports may be inefficient.

By default, a new Email Log Database partition is created after 5 GB of data has been stored in a single partition. You can also configure Forcepoint Email Security to create a new partition based on a weekly or monthly time interval.

Review the size and content of the partitions in the database after your system has been installed and receiving data for a few days, then tune the partitioning configuration accordingly.

For information on managing partitions in Forcepoint Email Security, refer to "Configuring Log Database options" in Forcepoint Email Security Administrator Help.


	Note Due to Microsoft SQL Server restrictions, you are limited to 70 active log database partitions. You may retain more than 70 partitions, but only 70 may be active (enabled) at any one time.

Factors affecting Data reporting performance

Forcepoint DLP automatically archives database partitions containing older data to reduce storage requirements and maintain a high performance reporting experience. To further reduce the data storage requirements, you can choose to create archive partitions sooner and keep fewer concurrent restored archives.

Refer to "Archiving incident partitions" in the Forcepoint DLP Administrator Help for more information on archiving.