Why is Endpoint Discover Agent multiple times slower than Network Discover?
Last Updated September 05, 2008
Discover scan of a workstation is faster than an Agent-based scan.
Relevant versions: 8.0 and up
A Network Discover scan of a workstation is expected to be faster than an agent-based scan due to the following:
A server has superior processing power compared to an Endpoint
Endpoint Discover scans are done in parallel (this is not the case for regular Discover scans)
An Endpoint Discover scan pauses if the Endpoint agent is busy with Endpoint Prevent, because Endpoint Prevent takes priority.
The Endpoint Discover scan pauses if the battery is low or if
runs out of space to store the files/incidents. (if this happens, it will show up in the logs at the FINE level)NOTE:Endpoint Prevent will never pause.
Throttling of the Endpoint agent, which makes sure the Discover scan does not affect usability of the agent machine. There is a setting in the UI labeled Maximum average CPU usage which can be adjusted.
When it comes to scanning a large number of workstations, the Endpoint agent has the performance advantage.
Imported Document ID: TECH219636
Subscribing will provide email updates when this Article is updated. Login is required to Subscribe