Excessive delays in processing newly entered data channel requests in larger environments with numerous data channel activities

Technical Articles ID: KB82022
Last Modified: 2024-01-06 08:20:30 Etc/GMT

Environment

Drive Encryption (DE) 7.x
ePolicy Orchestrator (ePO) 5.x

For details of DE 7.x supported environments, see KB79422 - Supported platforms for Drive Encryption 7.x.

Summary

This article provides suggestions to improve your data channel efficiency, particularly in large environments.

IMPORTANT: We recommend that you try each solution in the order listed. Continue with the next solution only if the previous solution does not address the problem.

Problem

In a larger environment with significant data channel saturation, a new wake-up call from ePO takes 30 minutes or more before the Agent Handler can pick up the call.

When you deploy DE in a larger environment, it might take several hours before client systems begin the encryption process.

Cause

The primary cause for this issue is that the retry mechanism for outbound data channel requests occupies worker threads on handlers for long periods of time. When an outbound data channel connection is made, the Agent Handler tries both the DNS lookup and TCP connection once for each Agent-Server Secure Communication (ASSC) key in the ePO console security keys page (Menu, Configuration, Server Settings, Security Keys).

The above is problematic, because the 'retry attempts' tie up the worker threads that process outbound data channel requests on Agent Handlers. The end result is that fewer processed requests per minute are handled.

The problem is magnified in larger environments where a significant part of these outbound requests fails. This action causes the handler to step through the time-intensive retry mechanism on a larger percentage of outbound requests.

Solution 1

Remove any unnecessary ASSC keys in the Security Keys page of the ePO console.

NOTES:

Each key has a number next to it that represents the number of agents that are using the key. If the key is listed as zero (0), it’s safe to back up and remove the key.
If you have keys imported for the transfer agent feature, those keys might not have any agents associated with them. If you delete those keys, the transfer agent feature no longer functions.

Log on to the ePO console.
Click Menu, Configuration, Server Settings.
Click Security Keys under the Setting Categories column, and then click Edit in the bottom-right corner.
Select a key that has 0 agents associated with it.
Click Export, OK, and then follow the browser steps for saving the file.
Select the key that you exported, and then click Delete, OK.
Repeat these steps until all unneeded ASSC keys are removed.

After you remove any unneeded ASSC keys, the handlers can process outbound communication attempts at a greater rate.

Solution 2

If the handler fails a DNS lookup on outbound data channel requests, that lookup is unnecessarily repeated for every ASSC key on the server. A code fix is available to change this behavior so that the DNS lookup is tried once for FQDN and once for NetBIOS. Fewer DNS lookups allow the Agent Handler worker threads to process the request faster.

The coder fix exists in all current supported versions of ePO.

If symptoms persist after installing this fix, continue to Solution 3.

Solution 3

The previous two solutions are both intended to increase the rate at which outbound data channel requests are processed. Another approach to this type of problem is to reduce the overall number of outbound data channel requests that are made.

If the first two solutions in this article do not resolve the problem, engage the product team where the requests originate, to investigate possible ways to reduce the overall number of outbound data channel requests.

To determine the source of the majority of data channel requests, perform the following SQL query against the ePO database:

Select Source, count (*) as 'Number of Occurrences' from EPOAgentHandlerDataChannelWQ Group By Source Order by Source asc

The results of this query list all sources for data channel requests ordered by the number of Occurrences. The item at the top of the list is the source responsible for the most data channel requests.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Excessive delays in processing newly entered data channel requests in larger environments with numerous data channel activities

Environment

Summary

Problem

Cause

Solution 1

Solution 2

Solution 3

Affected Products

Languages:

Title

Title

Knowledge Center

Excessive delays in processing newly entered data channel requests in larger environments with numerous data channel activities

Environment

Summary

Problem

Cause

Solution 1

Solution 2

Solution 3

Affected Products

Languages:

Choose your region

Title

Title