locked
Forefront client slowing down Copying RRS feed

  • Question

  • When copying folders with some typical apps (for example " Program files"), my w2k8 x64 server is very slow: 35MB/s with FCS service stopped, with service running only 5MB/s and the MsMpEng process uses 1 CPU core at 100%.

    Is there any performance tuning that can be done, like with most virus scanners? For example, I'd like to scan only on write (rather than any file access) and only for default file types (instead of everything). I already tried disabling all other checkboxes except for " On access protection" under " Options - Real-time protection" options, but that did not help at all.

    Also, looking at Filemon logging it seems the process touches everything repeatedly as it is used (for example in System32), rather than some "intelligent scanning" like MCafee uses? I used to use NOD32 before and it seemed to suffer the same type of performance hit somehow, so it may be OS related (never had any probs on w2k3 SP2 before that).

    Any thoughts?

    Will Stirling perform better?
    • Edited by MoonenJH Saturday, September 13, 2008 12:32 PM
    Saturday, September 13, 2008 12:31 PM

All replies

  • Hi

    Is this running Forefront on a 2008 64 bit server?  If so, have you installed Service pack 1 for Forefront yet?
    Monday, September 15, 2008 10:27 AM
  • Yes and yes, and w2k3sp2 as well.
     
    Today I  also did a quick comparison with MCAfee Enterprise 8.5i Patch 6 (latest engine+ DAT), and Forefront is about 2-3 times (!) slower than MCAfee when copying the same folder on my AMD X2 5600+ home server, and also on a w2k3sp2 HP Proliant DL360G5 server at work. Note: that is with optimized MCAfee settings: scan on write only, default file types (and both apps with heuristics disabled).

    To me this is unacceptable, especially it seems that not much performance tweaking can be done with FF (as mentioned before: write only, specific types, etc.). Has performance always been this bad, or might this be some bug/misconfiguration?
    Monday, September 15, 2008 7:07 PM
  • Does Forefront allow for real-time protection on write access only?  I currently see some performance issues with real-time protection enabled on my main file server, and would like to change it to scan on write operations only, but dont see a way to configure that...

    Saturday, January 9, 2010 2:46 PM