What about Staggering Multiple Scan Schedules?
Staggering schedules prevents resource contention on your Agents, your network, and the target systems themselves.
Why Staggering is a Best Practice
- Agent Availability: While a single agent can handle multiple threads, running too many scans simultaneously can lead to performance degradation or "queued" work that takes longer to start.
- Target Performance: If you scan multiple file shares or databases at the exact same time, you may hit IOPS limits or trigger throttling (especially in cloud environments like M365).
- Network Bandwidth: Staggering ensures that the "Result Shipping" phase (where Agents send their search findings back to the console) doesn't saturate your outbound network connection all at once.
- Predictable Reporting: It is easier to troubleshoot a failed scan when you know exactly which job was running during a specific time window.
How to Stagger Schedules Effectively
archTIS recommends "slicing" your environment and assigning them to different time boundaries:
Stagger by Target Type
- Endpoints: Schedule these for mid-day when machines are likely to be online, but stagger them across different days of the week for different departments.
- Server/Cloud Targets: Schedule these for late-night or weekend maintenance windows.
Stagger by Time Window (The "Wave" Approach)
Instead of starting everything at midnight, create a "wave" of starts as follows:
- Scan A (High Priority): Starts at 10:00 PM Saturday.
- Scan B (Medium Priority): Starts at 1:00 AM Sunday.
- Scan C (Large Archive): Starts at 4:00 AM Sunday.
Stagger by Business Unit or Region
If you have a global environment, stagger scans based on local time zones to ensure you are always scanning during "off-peak" hours for that specific region.
Operational Tip: Use "Search History" to Your Advantage
Because Spirion uses Search History to perform incremental scans, your weekly or daily runs will naturally become shorter over time.
- Initial Baseline: Expect the first run to take the longest. You may need to stagger these very aggressively (for example, 1 per night).
- Steady State: Once the baseline is complete, the scans will finish much faster. You can then "tighten" your staggered schedule because the overlap between jobs will be minimal.
Summary
To stagger your schedules, simply go into each Scan Definition, navigate to the Scheduling tab, and set unique Start Times and Days for each definition.
This ensures your scanning program remains an "operational posture" rather than a series of resource-intensive incidents.