• Article

Trend ScanMail low thread count

[This topic is intended to address a specific issue called out by the Exchange Server Analyzer Tool. You should apply it only to systems that have had the Exchange Server Analyzer Tool run against them and are experiencing that specific issue. The Exchange Server Analyzer Tool, available as a free download, remotely collects configuration data from each server in the topology and automatically analyzes the data. The resulting report details important configuration issues, potential problems, and nondefault product settings. By following these recommendations, you can achieve better performance, scalability, reliability, and uptime. For more information about the tool or to download the latest versions, see "Microsoft Exchange Analyzers" at https://go.microsoft.com/fwlink/?linkid=34707.]  

Topic Last Modified: 2009-09-29

The Microsoft® Exchange Server Analyzer Tool reads the following registry entry to determine the value for MaxScanningThreadCount:

HKEY_LOCAL_MACHINE\Software\TrendMicro\ScanMail for Exchange\RealTimeScan\ScanOption

The MaxScanningThreadCount registry value represents the maximum number of threads that ScanMail for Exchange can create for scanning. The default value is 12.

The Exchange Server Analyzer also reads the following registry entry to determine if Virus Scanning API (VSAPI) message scanning is enabled:

HKLM\System\CurrentControlSet\Services\MSExchangeIS\VirusScan\Enabled

A value of 1 for Enabled indicates that VSAPI scanning is enabled. A value of 0 indicates VSAPI scanning is not enabled.

The Exchange Server Analyzer also queries the Win32_ComputerSystem Microsoft Windows® Management Instrumentation (WMI) class to determine the following:

  • If the NumberOfLogicalProcessors property exists in WMI, the Exchange Server Analyzer determines the current value for NumberOfLogicalProcessors. NumberOfLogicalProcessors returns the logical processor count in the computer. This property is available in Windows Server 2008. By default, NumberOfLogicalProcessors is not available in Windows Server 2003. The hotfix that is mentioned in Microsoft Knowledge Base article 932370, "The number of physical hyperthreading-enabled processors or the number of physical multicore processors is incorrectly reported in Windows Server 2003" (https://go.microsoft.com/fwlink/?linkid=3052&kbid=932370) adds the NumberOfLogicalProcessors property to Windows Server 2003.

  • If the NumberOfLogicalProcessors property does not exist the Exchange Server Analyzer determines the current value for NumberOfProcessors. In Windows Server 2008, NumberOfProcessors only returns the number of physical processors. By default, in Windows Server 2003, NumberOfProcessors returns the number of logical processors.

The returned value represents the number of processors installed on the computer, and it includes both physical processors and logical processors. Using Hyper-Threading technology from Intel, a physical processor can be split into two logical processors.

The Exchange Server Analyzer also queries the Active Directory® directory service to determine the number of objects with an object class of msExchPrivateMDB. The count of these objects represents the number of mailbox stores on this Exchange Server computer.

If the Exchange Server Analyzer finds that the value for MaxScanningThreadCount is less than (2 × NumberOfProcessors + 1) + 3 + the number of mailbox stores on an Exchange Server computer that has VSAPI scanning enabled, a warning is displayed.

Note

If Hyper-Threading is enabled, the value for the number of logical processors will be double the number of physical processors. It is recommended that you use the above formula for systems that have physical processors, as well as for systems that have both physical and logical processors.

This warning indicates that the MaxScanningThreadCount registry value may not be optimized for your environment. This value should be set to be at least equal to the attachment size limit you have set on your Exchange servers. For information about a related registry value, see Trend ScanMail low thread pool count.

Important

This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore the registry if a problem occurs. For information about how to restore the registry, view the "Restore the Registry" Help topic in Regedit.exe or Regedt32.exe.

To correct this warning

  1. Open a registry editor, such as Regedit.exe or Regedt32.exe.

  2. Navigate to: HKLM\Software\TrendMicro\ScanMail for Exchange\RealTimeScan\ScanOption

  3. In the right pane, double-click MaxScanningThreadCount.

  4. Enter a value recommended by the Exchange Server Analyzer.

  5. Close the registry editor and restart the ScanMail_RealTimeScan service and the Microsoft Exchange Information Store service for the change to take effect.

Before you edit the registry, and for information about how to edit the registry, read the Microsoft Knowledge Base article 256986, "Description of the Microsoft Windows Registry" (https://go.microsoft.com/fwlink/?linkid=3052&kbid=256986).

For more information about Hyper-Threading technology, visit the Intel Web site.

Note

Web addresses can change, so you might be unable to connect to the Web site or sites mentioned here.