[ER] Match Inspector showing "Remaining data truncated"

Introduction

Enterprise Recon is designed to report one hundred bytes of contextual data from either side of each match. This data is compressed and encrypted by the Node Agent software before transmission to the Master Server appliance.

When a scan detects a large number of matches in a target location, the match inspector may display the message "Remaining data truncated". This article explains why.

 

Understanding Thresholds

Under high match volumes the software introduces thresholds to limit the amount of data being transferred across the network and being stored on the Master Server appliance. These thresholds have been put in place as a safeguard to ensure that the system does not experience performance problems. As the number of matches enters the tens of thousands and the thresholds are reached, the amount of contextual data is reduced to just the bytes appearing within the match.

When the total compressed size exceeds a predetermined threshold (about 30MB), the engine will switch to only recording the total count of matches (per data type searched) for each path, rather than the contextual data. From that point onwards, the system will record only the paths and match counts up to a final threshold limit of 64MB.

Have more questions? Submit a request

0 Comments

Please sign in to leave a comment.