Configuring the number of scan engines used for each scan

 

Applies to: Forefront Protection for Exchange

The Engines and Performance setting controls how many of the selected engines should be used in order to provide you with an acceptable probability that your system is protected. There is a trade-off between increasing the probability of catching a virus and maximizing your system performance. The more engines you use, the greater the probability that all viruses will be caught. However, the more engines you use, the greater the impact on your system's performance.

You can have a different Engines and Performance setting on different servers, depending on your needs. For example, you might want to use only a single engine on your mailbox server, to maximize its system performance. Then, you can use several engines on your Edge or Hub transport servers.

Note

The Engines and Performance setting only applies to virus scanning. It is not used in filtering, spyware scanning, or spam scanning. You must select the policy for each scan (realtime, transport, scheduled, and on-demand) you configure; it is not global.

To configure the number of scan engines, select from the following Engines and Performance options:

  • Scan with all engines—Queues scanning if any selected engine becomes busy, such as during engine updates. Depending on the number of engines that you have selected for each scan job, this option generally increases the probability of virus catching at the expense of system performance.

  • Scan with the subset of engines that are available—Scans with all selected engines that are available. Scans continue with the available engines when one of the selected engines is being updated. Depending on the number of engines that you have selected for each scan job, this option generally increases the probability of virus catching but not at the expense of delays in mail flow. This is the default value for all scan jobs.

  • Scan with a dynamically-chosen subset of engines—FPE heuristically chooses from the selected engines, based on recent results. (Results are determined by when the engine or its definitions were last updated, and whether the engine recently incurred any errors.) On average, half of the selected engines are used in scanning any single object, so this setting can be seen as a neutral option that does not favor system performance over virus catching (and vice versa).

  • Scan with only one engine—FPE heuristically chooses only one engine from the selected engines, based on recent results. (Results are determined by when the engine or its definitions were last updated, and whether the engine recently incurred any errors.) This option increases system performance but is not the optimal setting for catching viruses since only one engine is used.

Click Save after making any changes to your settings. For additional information about fine tuning scan engines for maximum performance, see Maximizing scan engine performance.

See Also

Concepts

Configuring the transport scan
Configuring the realtime scan
Configuring the scheduled scan
Configuring the on-demand scan