About network performance
Applies To: Forefront Client Security
The total impact that a single Client Security agent will have on network performance is determined by the following variables:
Average size of the alerts and events while the client computer is on the network
Average number of alerts and events per Client Security agent
Frequency of definition updates that the Client Security agent receives from the distribution server
For information about the size of events and alerts, see Impact on server system resources.
Events and alerts
The following table describes the average number of alerts and events per Client Security agent per day during performance tests. These values vary due to a number of factors, including the number of scans performed per day and the number of threats detected in an environment per day. These values are presented here for example purposes only.
| Communication type | Approximate frequency (average per Client Security agent per day) |
|---|---|
Event |
20 |
Alert |
.2 to .4 |
You can control event and alert frequency. Event and alert thresholds are controlled by Client Security policy. For more information about configuring events and alerts, see Working with alerts in the Client Security Administrator's Guide (https://go.microsoft.com/fwlink/?LinkID=86813).
Definition updates
Definition updates can also affect the network performance of client computers. On average, definition updates are published one to seven times a day; the frequency is dependent on the current threat environment. For more information about definition sizing, see Impact on server system resources.
Under certain conditions, Client Security agents check for definition updates prior to scans. Malware scans originating from the client UI do not trigger definition updates. Checks for definition updates are triggered when:
You run malware scans (quick and full) from the console.
A scheduled SSA scan begins.
A scheduled malware scan begins, if the policy is so configured.
You can control how often Client Security agents check for definition updates from the distribution server. For information about changing the frequency of update checks, see Configuring checks for definition updates in the Client Security Administrator's Guide (https://go.microsoft.com/fwlink/?LinkId=87163).