Calculating the number of scan processes and scan threads for Symantec Mail Security for Microsoft Exchange (SMSMSE)

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

How many VSAPI scanning threads should be configured SMSMSE?

What impact will this number have on performance?

Should the number of VSAPI scanning threads always be the same as the number of scan processes?

 

Resolution

Setting scanning threads and number of scan processes

To control (tune) scanning speed and performance, Symantec Mail Security allows administrators to set the number of VSAPI scanning threads and the number of scan processes. It is recommended to initially configure the number of VSAPI scanning threads and the number of scan processes as per the instructions below, monitor performance and make adjustments (override the defaults) if necessary.

VSAPI Scanning Threads:

Note: The VSAPI interface has been discontinued as of Exchange 2013. An implementation of SMSMSE on any version of Exchange 2013 or above will not have the VSAPI scanning threads option in the interface. This is by design.

The base number of VSAPI scanning threads should be calculated per the formula:

2*(physical processor cores) + 1

For example, if the computer has two processor sockets with two cores each the following is the calculation:

2*(Number of processors (2) x number of processor cores (2)) + 1 = 9

 

Scan Processes:

The base number of VSAPI scanning processes should be calculated per the formula:

2*(physical processor cores) + 1

For example, if the computer has two processor sockets with two cores each the following is the calculation:

2*(Number of processors (2) x number of processor cores (2)) + 1 = 9

NOTE: Microsoft recommends not using processor hyperthreading with Exchange.  See this Microsoft article for more details: Understanding Processor Configurations and Exchange Performance.  Virtual hyperthreaded processors should not be counted as processors or cores in the calculations above.  The additional virtual processors should be ignored for purposes of this calculation.

Fine tuning the VSAPI Scanning Threads and Processes

The above formulas are intended as a base "best practices" setting, but do not address the specific needs of individual environments.
In some cases, an organization may want to configure more or less scan threads/processes based on actual scanning requirements and available system resources.

In general, the more scan threads/processes are configured, the faster emails will be scanned in real time, and the lower the likelihood of mail flow delays due to insufficient scanners being available to process emails as needed. However, too many scan threads can also introduce problems with system resources. For example if each scan process is using 150 mb of RAM, and the system has 500 mb of free RAM available to dedicate to scanning, the system will only support 3 scan processes before performance is negatively impacted. This has the effect of limiting the maximum number of scan threads that can be run on the system without introducing problems.

Conversely, if too few scan threads are configured, mail can back up in the Exchange Virus Scan queue during peak load times, and potentially disconnect clients from the Exchange server as the clients will need to wait for virus scans to complete before being allowed access to items in the store.  To determine if mail flow is being impacted by too few scan threads, use Performance monitor to monitor the Virus scan queue length:

1. Open Performance monitor (Start -> Run, Perfmon).

2. Under the Performance Monitor window, click Add.

3. Under the Performance Counters heading, locate and expand the object MSExchangeIS.

4. Under the MSExchangeIS heading, select "Virus Scan Queue Length" and click Add >> then click OK.

The Virus Scan queue length should stay at or near 0 at all times. If the number is consistently above 10, it is likely the system does not have enough scan threads/processes configured. Slowly increase the number of scan threads/processes until the Virus Scan Queue length counter is consistently at or near 0 at all times. Take care not to set this number higher than the free RAM available to the system can support.

To set (change) scanning threads and number of scan processes:

1. On the primary navigation bar, click Admin.
2. In the sidebar under Views, click System Settings.
3. In the Number of VSAPI Scanning Threads box, type the number of threads to use for VSAPI scanning.
4. In the Number of Scan Processes box, type the number of scan processes.
5. To apply the changes, click the Deploy changes/Deploy all icon.
 

References
Full details on configuring and administering Mail Security for Microsoft Exchange can be found in the implementation guide. The latest version of all product documentation can be downloaded from http://www.symantec.com/business/support/documentation.jsp?language=english&view=manuals&pid=51980

Technical Information
Please note that when calculating the initial default values, Symantec Mail Security accepts Windows consideration that a hyper-threaded processor is more than one processor. To determine how many processors and cores are in a computer, run msinfo32.exe on your Exchange server.

After the scan processes value is set, there should be a corresponding number of SAVFMSESp.exe processes seen in Task Manager.