Email DLP Queue Monitoring
Monitor Email DLP pipeline queue depth, processing latency, and delivery health
using four dashboards that give you real-time, historical, and alerting visibility across
every stage of the pipeline.
| Where Can I Use This? | What Do I Need? |
|---|
Enterprise Data Loss Prevention (E-DLP) routes every forwarded email through a three-stage pipeline: an
inbound SMTP host receives mail from your email service, Enterprise DLP inspection
and policy evaluation, and an outbound SMTP host delivers the processed message to the
next hop. Messages can accumulate at each stage for different reasons. For example,
waiting for a scan result, awaiting delivery after inspection, retrying after a failed
delivery attempt, or delayed after Enterprise DLP sends a Delivery Status
Notification (DSN) to the sender. Each stage contributes its own latency, and problems
at any point can affect users before they appear in the Email DLP logs.
Email DLP gives you continuous visibility into this pipeline using four dashboards:
Queue Monitor
Use this dashboard to detect growing backlogs before users notice delivery
delays. The Now Panel shows current queue depth for each pipeline stage alongside
average, P50, and P95 statistics for the last five minutes and a sparkline
showing the depth trend. Refresh manually to get the latest snapshot.
Queue Historical
Use this dashboard to reconstruct the timeline of a delivery incident, verify
that a backlog has cleared, or identify recurring patterns such as daily
peak-hour queue growth. Time-series charts show Scan Pending and Delivery
Pending depth over your selected window, with Delivery Pending broken into
Deferred and Delayed sub-components. Average and P95 dwell time per stage shows
how long messages spent at each pipeline stage.
Processing Statistics
Use this dashboard to determine whether latency or throughput issues are
affecting the pipeline. Scan latency and total latency appear as average and P95
values. Throughput counters show Delivered and Not Delivered message counts.
Size-bin charts and a summary table break processing and delivery time down by
message size so you can determine whether large attachments are driving latency
increases.
Incident Statistics
Use this dashboard to confirm that alerting is active and to investigate which
policies, data profiles, or sender users are generating the most incidents.
Threshold status cards show live alert state across delivery failure rate,
deferred queue depth, and processing latency. Filterable charts show incident
volume and email volume trends, and Top 5 widgets rank incidents by policy, DLP
data profile, or sender user. Update threshold values and notification recipients
from this view or from
Email DLP alert settings.
Queue Monitor
View the Queue Monitor dashboard to see a live snapshot of current message depth
in each Email DLP pipeline stage and detect growing backlogs before users notice delivery
delays.
Log in to
Strata Cloud Manager.
Select and choose
Email DLP.
Select
Queue Monitor.
Click
Refresh to update the current queue status.
You must manually refresh the current queue status. Email DLP doesn't
automatically refresh the current queue status.
In the
Now Panel, review the current queue depth for
each pipeline stage.
Scan Pending Queue—Messages awaiting DLP inspection by Enterprise DLP.
Delivery Pending Queue—Messages that completed inspection and
are queued for delivery to the next-hop mail server.
Delivery Pending - Deferred Queue—Messages with at least one
failed delivery attempt that are awaiting retry.
Delivery Pending - Delayed Messages—Messages for which Enterprise DLP sent a Delivery Status Notification (DSN) to the
sender.
A green Live Monitoring indicator at the bottom of the panel confirms the
data is current.
Review the average, P50, and P95 depth statistics for each stage to
understand normal operating ranges over the last five minutes.
P50 is the depth that half of all five-minute samples fall below. P95 is the
depth that 95 percent of samples fall below. A low P50 with a high P95
means the queue is typically shallow but experiences short bursts of
elevated depth that the average does not capture.
Review the sparkline trend for each stage to determine whether queue depth
is stable, growing, or declining.
A sparkline trending upward over the five-minute window indicates an
accumulating backlog. If Scan Pending Queue or Delivery Pending Queue are
growing, use the Queue Historical dashboard to see how long the trend has
been developing.
Queue Historical
View the Queue Historical dashboard to analyze Email DLP queue depth trends and
per-stage dwell times across selectable time windows from real time to 30 days.
Log in to
Strata Cloud Manager.
Select and choose
Email DLP.
Select
Queue Historical.
Choose a time window to set the scope of the
Queue Historical
Dashboard and
Dwell Time by Stage.
Real Time—Live queue depth sampled at short intervals.
Last 15 min, Last 30 min, Last 1 hour, Last 3
hours—Recent operational windows for active
troubleshooting.
Last 12 hours, Last 24 hours, Last 2
days—Day-scale operational windows for post-incident review.
Last 7 days, Last 30 days—Trend windows for identifying
recurring patterns or capacity growth.
Review the
Queue Historical Dashboard to identify when
queue depth increased and which stages were affected.
The chart plots time on the x-axis and message count on the y-axis. The
Delivery Pending stage is displayed as a stacked step line that separates
Deferred and Delayed sub-components so you can distinguish messages actively
awaiting retry from those that have already generated delay notifications.
Scan Pending is plotted as a separate step line.
Use the Avg / P95 toggle in the
upper-right corner of the chart to switch between average queue depth and
95th-percentile depth for the selected time window.
Review the
Dwell Time by Stage metrics for the selected
time window to understand how long messages spent in each pipeline stage.
The Dwell Time by Stage section shows a widget for each pipeline stage:
Scan Pending Queue, Delivery
Pending Queue, Delivery Pending -
Deferred, and Delivery Pending -
Delayed. Each card shows average dwell time (seconds) and
P95 dwell time for the selected window.
Average dwell time reflects typical processing speed per stage. P95 dwell
time surfaces the slowest 5 percent of messages and is a stronger indicator
of user-visible delay than the average.
Processing Statistics
View the Processing Statistics dashboard to analyze Email DLP scan latency,
delivery latency, and throughput by message size for time windows up to 90
days.
Log in to
Strata Cloud Manager.
Select and choose
Email DLP.
Select
Processing Statistics.
Choose a time window to scope the performance metrics on the dashboard.
Available time windows range from Last 5 min to
Last 90 days. Shorter windows support active
troubleshooting; longer windows support trend analysis and capacity
planning.
Review the
Scan Latency widget to assess
Enterprise DLP inspection performance.
Scan latency is the time from when Enterprise DLP receives a message
to when it produces a policy verdict. Average scan latency reflects
typical inspection speed. P95 scan latency shows the upper bound for
95 percent of messages and identifies whether outlier scans are affecting
the pipeline.
Review the
Total Latency widget to assess end-to-end pipeline performance.
Total latency is the time from message receipt to delivery to the next-hop
mail server. It includes both scan time and any delivery queue wait time.
If total latency is significantly higher than scan latency, retry attempts
or slow next-hop connectivity are contributing to the overall delay.
Review the throughput counters to see how many messages
Enterprise DLP
processed in the selected time window.
The dashboard shows two counters: Delivered counts messages
successfully delivered to the next hop, and Not Delivered counts
messages for which Enterprise DLP sent a Non-Delivery Report (NDR)
to the sender after exhausting delivery retries.
Review the
DLP Processing Time by Message Size and
Delivery Time by Message Size charts to determine
whether attachment size is driving latency increases.
Each chart plots average and P95 time (in seconds) across eight size
bins:
Less than 10 KB
10 KB to 100 KB
100 KB to 250 KB
250 KB to 500 KB
500 KB to 1 MB
1 MB to 10 MB
10 MB to 50 MB
50 MB to 150 MB
If only the larger bins show elevated latency, attachment size is the cause
rather than overall service load. If all bins show elevated latency, service
capacity or downstream connectivity is more likely the cause.
Below the charts, the Processing & Delivery Metrics by
Message Size table shows the same data in tabular form with
four columns: DLP Scan Avg (s),
DLP Scan P95 (s),
Delivery Avg (s), and
Delivery P95 (s). Size bins with no
messages in the selected time window show a dash.
Incident Statistics
View Email DLP alert threshold status and analyze incident trends by severity,
action, and policy dimension using filterable charts and Top 5 rankings.
Log in to
Strata Cloud Manager.
Select and choose
Email DLP.
Select
Incident Statistics.
Review the status of each alert threshold to confirm alerting is active and
thresholds are set correctly for your environment.
Failed Delivery Percentage—Triggers when more than the
configured percentage of messages fail delivery in a 10-minute
window. A sustained high failure rate indicates that the next-hop
mail server is unavailable or rejecting messages.
Deferred Queue Count—Triggers when the number of messages
awaiting retry reaches or exceeds the configured count over a
15-minute window. A growing deferred queue indicates that Enterprise DLP is retrying delivery to a slow or unavailable
downstream server.
Average DLP Scan Duration—Triggers when the average
inspection time per message exceeds the configured threshold in
seconds over a 10-minute window. Elevated average scan times
indicate load or performance degradation in the Enterprise DLP service.
P95 DLP Scan Duration—Triggers when the 95th-percentile
inspection time per message exceeds the configured threshold in
seconds over a 10-minute window. P95 latency surfaces outlier
scan delays that average metrics miss and is a leading indicator
of service-level risk.
Use the filter dropdowns to scope the incidents analytics charts.
Time filter—Choose Past 24 Hours,
Past 7 Days, Past 30
Days, or Past 90 Days to set
the scope of the incidents charts and Top 5 widgets.
Severity—Choose All,
Very Low, Low,
Medium, High, or
Critical to filter incidents by policy
match severity.
Action—Choose All,
Monitored,
Blocked, Manager
approval, Admin approval,
Quarantined, or
Encrypted to filter by the action
Enterprise DLP applied to matched messages.
Insight—Choose Policy,
DLP Data Profile, or Sender
User to set the grouping dimension for the Top 5
widgets.
Review the
Incidents in the Past chart to see how
incident volume trended over the selected time window.
The line chart plots incident count over time, with separate lines for each
severity level. Use this chart to identify spikes in policy matches and
correlate them with changes in email traffic or policy configuration.
Review the
Email Volume chart to see how processed
message volume trended over the selected time window.
The line chart plots email count over time, with separate lines for each
action value. Use this chart alongside the incidents chart to determine
whether an incident spike reflects a policy sensitivity change or an
actual increase in risky email traffic.
Review the
Top 5 most matched widget to identify which
policy rules, data profiles, or sender users generated the most incidents.
The widget displays a vertical bar chart ranked by incident count for the
Insight view you select. Each Insight option changes what the x-axis
represents and whether a drilldown table appears when you select a bar.
Email DLP Policy
Use this view to identify which
Email DLP policy rules are
generating the most incidents and to confirm that high-match counts
reflect expected enforcement rather than misconfigured policy
rules.
DLP Data Profile
Use this widget to trace high-incident data profiles back to the
specific policies that reference them. Select a data profile bar to
open a detailed summary about that specific data profile. The table
title identifies the matched data profiles and lists the
Email DLP policy rules that
reference them. Click the
Policy Name
to view a specific Email DLP policy rule.
Sender User
Use this view to identify users who are frequently sending sensitive
content. Select a sender bar to open a detailed summary about that
specific sender. The table title identifies the matched sender and
lists the
Email DLP policy
rules that matched their messages. Click the
Policy Name to view a specific
Email DLP policy rule.
(
Optional)
Configure the Email DLP Alert
Settings.
Enter threshold values that reflect your organization's normal operating
ranges. Alerts have a 15-minute cooldown. If a condition remains breached
after the cooldown expires, Enterprise DLP sends another notification.
Alert notifications are sent from
dlp-noreply@paloaltonetworks.com. Add this address to
your organization's allow list to prevent notifications from being filtered
as spam.
