Sign in
 
HomeProductsLibraryLearnDownloadsSupportForums
Microsoft Forefront TechCenter >
> 
> 
Forefront - realtime scan exceeded allowed scan time limit

Beantwortet Forefront - realtime scan exceeded allowed scan time limit

  • Wednesday, January 09, 2013 7:39 PM
     
     
    Sign In to Vote
    0

    Hello All,

    We are running Exch 2010 SP 2 w FFPE v. 11.0.727.0.  This has been running without issue but now we are seeing that messages are being removed because  the scans are exceeding realtime timeout.  It is removing random messages (no consistency to size, attachment, etc) all for the same timeout.  We have temporarily set the action to skip detect so that the messages aren't removed.

    Does anyone have any insight as to why the time keeps being exceeded?  The timeout settings are the default (150 seconds), we are scanning with a subset of engines, the server has been rebooted to no avail.

    Thanks in advance!!!

     

All Replies

  • Wednesday, January 09, 2013 11:59 PM
     
     
    Sign In to Vote
    0

    Hi,

    as far as I know the Default value for the timeout is 600 so you should set it back to 600.

    Set it back to 600 with the following command in the Forefront Management Shell:

    Set-FseRealtimeScan -Timeout 600

    After that don't forget to restart the informationstore.

    Greetings

    Christian

    Christian Groebner MVP Forefront

     
  • Thursday, January 10, 2013 2:24 PM
     
     
    Sign In to Vote
    0

    Hi Christian,

    Thank you for the reply.  I show 2 different timeouts - one for Mailbox Realtime (150 secs) and one for Hub Transport (600 secs).  I believe we have not changed any of the default timeout settings anywhere.

    Aside from that, any other possible reasons that it would be timing out?

    Best,

    Darrell

     
  • Thursday, January 10, 2013 2:38 PM
     
     
    Sign In to Vote
    0

    Hi,

    I've checked it with my installations and the default timeout value is 600 for both scan jobs.

    Reasons for the timeout are huge attachments or huge workload on the server.

    Greetings

    Christian

    Christian Groebner MVP Forefront

     
  • Thursday, January 10, 2013 6:44 PM
     
     
    Sign In to Vote
    0

    Hi,

    In this article, it states that 150 is the default - http://technet.microsoft.com/en-us/library/cc483036.aspx

    Is it possible it was changed per a best practices article or something?  If so, would you happen to have that?

    Best,

    Darrell

     
  • Friday, January 11, 2013 6:27 AM
    Moderator
     
     
    Sign In to Vote
    0

    Hi,

    Thank you for the post.

    Please also check if all the engines are updated, and if you have disabled VB engine as per: http://support.microsoft.com/kb/2758276/en-us

    Regards,

    Nick Gu - MSFT

     
  • Thursday, January 17, 2013 3:02 PM
     
     Answered
    Sign In to Vote
    0

    We ended up opening a call with MSFT - troubleshot the issue, uninstalled/reinstalled still to no avail.  Throughout all of this, it seemed as though the server was sluggish even though it had more than enough processors and memory available.  We ended up running some firmware updates on the server which sped everything up noticeably.  After this, we were able to enable all realtime scanning without timeouts.

    As a side note, here are the changes that we changed as 'best practice' while working with MSFT

    Scanning Timeout - set to 600 from 150 (default) for Mailbox, Transport, Scheduled

    Under Engines and Performance - Scan with a dynamically-chose subset of engines

    Disable VirusBuster as mentioned above (we had already done that)

    Stagger Engine update times

    Increased Engine download timeout (we set to 800)

    Hope this helps!

    • Marked As Answer by da_crusher Thursday, January 17, 2013 3:02 PM
    •