locked
FCS ignoring exclusion lists RRS feed

  • Question

  • Hey People,

    Yes, we're still using FCS (I know it EOLs in a couple of months, but our Ops team haven't gotten around to a replacement yet...), but I'm finding on my Server 2012R2 servers, that it's ignoring the Folder and Process exclusion lists.

    More specifically:

    FCS Client v1.5.1996.0, Engine v1.1.11602.0

    Windows Server 2012R2 patched up to April 2015.

    Also running SharePoint 2013, patched up to April 2015 CU, this is a two server farm, with this server being the "Application" server, the other is the WFE.

    All runing under VMWare.

    We found that during SharePoint crawls, FCS would go nuts, using about 30-40% of total CPU (dual core), which caused massive delays in crawl times and seemed to impact on WFE performance too (suspect delays in App server performance caused delays in service requests by WFE).  I've used Sysinternals ProcMon to determine that the FCS process is indeed still scanning the excluded locations.

    So I added the standard SharePoint folders to the FCS exclusion list and restarted the FCS services, but no change.
    So I added the SharePoint searh processes to the exclusion list and restarted the FCS services, but no change.
    So I rebooted the server, but no change.

    Microsoft have quite a long list of things to exclude, but until I can get any exclusions working, there's no point in adding more.

    Is anyone else seeing this?
    Has anyone come up with a solution?

    I don't really want to turn FCS off, but the performance difference is night-and-day!

    Thanks
    Craig



    Tuesday, May 12, 2015 1:53 AM

All replies

  • Hi,

    How do you confirm the exclusions not work?

    Best Regards,

    Joyce


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, May 13, 2015 2:32 AM
  • Hey Joyce,

    Thanks for responding.
    As I said in my original post, I've configured the exclusions in the FCS UI:
    FCS Exclusions

    But I'm still seeing FCS touching the excluded files, thanks to ProcMon:

    FCS Touching excluded files

    Does that help?

    Thanks
    Craig

    Wednesday, May 13, 2015 3:29 AM
  • Hi,

    Have you checked if the exclusion paths list in the client registry? The following list the registries path.

    https://technet.microsoft.com/en-us/library/bb418808.aspx?f=255&MSPPError=-2147217396

    Please also check MPLog-daterange.log.

    Best Regards,

    Joyce


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, May 13, 2015 9:41 AM
  • Thanks Joyce,

    yes, the registry keys appear to be correct (including a folder I've since removed):

    FCW Exclusion Folders Registry key

    And processes:

    FCS Excluded processes registry keys

    However I've been unable to locate the MPLog-*.log files.  I thought they would be in C:\Program Files\Microsoft Forefront\Client Security\Client\Logs or c:\windows\temp but they are not.  Is there another location I should be looking? (Note: I did a search on c: for MPLog*.log but it didn't find anything)

    Thanks
    Craig

    Wednesday, May 13, 2015 9:39 PM
  • We've now upgraded to System Center End Point Protection:

    Antimalware Client Version: 4.3.220.0
    Engine Version: 1.1.11804.0
    Antivirus definition: 1.201.1280.0
    Antispyware definition: 1.201.1280.0
    Network Inspection System Engine Version: 2.1.11804.0
    Network Inspection System Definition Version: 115.3.0.0

    However we still have the same problem. I've encouraged our operations team to raise a support call with Microsoft.

    Thursday, July 9, 2015 2:48 AM