When you have too many rules enabled on the assigned Deep Security policy, the following event may show on the Deep Security Manager (DSM) console:
Agent configuration package too large
There is a configuration limit of 20MB in Windows 32-bit platform because it has smaller kernel memory available. For other platforms, the limit is 32MB. Once the server reached the limit, you will receive "Agent configuration package too large" warning on Deep Security Manager console.
The size depends on the number of rules for Intrusion Prevention. When you got the warning, it usually means you may have assigned too many rules that may cause performance degradation.
To avoid this issue, you can perform Scan for Recommendations to check if any rules are recommended to be removed. You may also consider applying patches for your OS or/and applications, then remove those rules that are not necessary for your system.
You can also disable the alert message using the procedure below:
- Log in to the Deep Security Manager console.
- Double-click the virtual machine (VM) that has the alert message.
- Go to Settings > Advanced > Agent configuration Size Warning.
- Set the value of "Generate an alert when agent configuration package exceeds maximum size" to No.
- Save the changes.
