Slow Virus Scanner Calls

[This topic is intended to address a specific issue called out by the Exchange Server Analyzer Tool. You should apply it only to systems that have had the Exchange Server Analyzer Tool run against them and are experiencing that specific issue. The Exchange Server Analyzer Tool, available as a free download, remotely collects configuration data from each server in the topology and automatically analyzes the data. The resulting report details important configuration issues, potential problems, and nondefault product settings. By following these recommendations, you can achieve better performance, scalability, reliability, and uptime. For more information about the tool or to download the latest versions, see "Microsoft Exchange Analyzers" at https://go.microsoft.com/fwlink/?linkid=34707.]  

Topic Last Modified: 2006-07-11

The Microsoft® Exchange Server Analyzer Tool examines the Exchange Function Call Log (FCL), the Store.fcl file, for Virusscan Virus API (VAPI) component events that exceed a response time of 2.5 seconds.

Exchange FCL Virusscan VAPI component events represent Microsoft Exchange Information Store service (Store.exe) function calls to external virus scanner software.

To enhance the troubleshooting of the VAPI, Exchange Server implements event logging that can be used to track the performance of the virus-scanning API.

Events that are logged include the following:

  • Loading and unloading of vendor DLLs.

  • Successful scanning of items.

  • Viruses that are located in the information store.

  • Unexpected behavior in the VAPI.

If the Exchange Server Analyzer finds events in the Store.fcl logging file that reflect a response time of more than 2.5 seconds for external virus scanner software function calls from the Microsoft Exchange Information Store service (Store.exe), the Exchange Server Analyzer displays an error.

When cross-component calls from the Microsoft Exchange Information Store service (Store.exe) wait for a response, remote procedure call (RPC) threads can back up behind these requests and lead to Exchange Server performance issues such as delays in server responses to clients.

Slow response times for Microsoft Exchange Information Store service (Store.exe) external function calls to the virus scanning software can be caused by the following conditions:

  • Updates to a virus scanner that generate a re-scan of items in the information store.

  • A misconfigured virus scanner

  • Virus scanner software processes a large message or attachment.

To resolve this error, take the following steps:

  • Schedule updates to your virus engine for times when resource consumption is low, that is, off-peak demand intervals.

  • Consider re-installing the virus scanning software, but reinstall at off-peak demand intervals.

  • Examine the configuration of your virus scanning engine for the correct thread configuration, file level exclusions, and so on. See Microsoft Knowledge Base article 823166, "Overview of Exchange Server 2003 and antivirus software" (https://go.microsoft.com/fwlink/?linkid=3052&kbid=823166).

  • Review the articles in the For More Information section of this document.

For More Information

For more information about virus-scanning programs that are typically used with Microsoft Exchange Server 2003, see the Microsoft Knowledge Base article 823166, "Overview of Exchange Server 2003 and antivirus software" (https://go.microsoft.com/fwlink/?LinkId=3052&kbid=823166).

For more information about virus-scanning programs that are typically used with Microsoft Exchange 2000 Server, see the Knowledge Base article 328841, "Exchange and Antivirus Software" (https://go.microsoft.com/fwlink/?LinkId=3052&kbid=328841).

For more information about Exchange Server performance, see the "Performance and Scalability Guide for Exchange Server 2003" (https://go.microsoft.com/fwlink/?LinkId=47576).

For more information about how to troubleshoot Exchange Server performance issues, see "Troubleshooting Microsoft Exchange Server Performance" (https://go.microsoft.com/fwlink/?LinkId=47588).

For more information about how to troubleshoot information store performance, see Microsoft Knowledge Base article 257725, "XADM: How to Collect Diagnostic Data for Information Store Troubleshooting" (https://go.microsoft.com/fwlink/?LinkId=3052&kbid=257725).