Hi,

We have installed ForeFrontProtection2010 forExchange in our environment for Exchange server 2010 SP2.

We are monitoring data for Realtime scanning through perfmon object Forefront Exchange Realtime Scanner.

We have observed that the no. of instances for Forefront Exchange Realtime Scanner in Perfmon corresponds to process count set in Policy Management->Antimalware->Mailbox Realtime->Additional Options->Process Count. So, if we set the process count to maximum value 10, no. of instances seen in perfmon application is 13 i.e. 10(processes) + 3 (Default instances: _CumulativeTotal, _RunningTotal, _total)

As per https://technet.microsoft.com/en-in/library/cc483036.aspx, the default value for Process Count is 4; the maximum value is 10.So, we can have at max 13 instances of Forefront Exchange Realtime Scanner in Perfmon.

Is the above observation correct or is it possible to have more than 13 valid instances for Forefront Exchange Realtime Scanner?

In one of the environment, we could see lot of instances for Forefront Exchange Realtime Scanner but, only 13 appeared to be valid.For rest, it more looked like the corrupt data.To fix the corrupt object,we tried reloading the perfmon counter but, it still shows up the same way.Any information on this is welcomed.

Thanks in ad

Hi,

please try to change the Process Count, then stop and start the Microsoft Exchange Information Store service in order for changes to this setting to take effect. Do not use the Restart function. How many instances do you have?

Best Regards,
Joyce

Hi Joyce ,

We did steps mentioned above, but still we see corrupted instances.

Instances count has reduced but, they are still more than 13 and are corrupted.

Thanks.