Antivirus programs may contribute to file backlogs in SMS 2.0 and in SMS 2003 (327453)

MORE INFORMATION

No specific antivirus program or program version causes this behavior. When files move between SMS components, they may appear to move slower than usual as each file is scanned by the antivirus program. If a collision occurs because of a file lock, processing may quit. If a collision occurs, then files start to accumulate on the SMS site server and create a file backlog.

Most of the time, SMS and an antivirus program can operate on the same computer if SMS operates within typical boundaries and if SMS is running on sufficient hardware.

• For more information about typical operating boundaries, see the SMS 2003 Capacity Planner. The following file is available for download from the Microsoft Download Center:
  
  Download the SMS_2003_Capacity_Planner.exe package now.
  
  Release Date: July 19, 2004
  
  For more information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:

  119591 How to obtain Microsoft support files from online services

  Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.
• For more information about hardware sizing and capacity planning, see chapter 9 in the SMS 2003 Concepts, Planning, and Deployment Guide. The following file is available for download from the Microsoft Download Center:
  
  Download the SMS2003_CPDGuide.exe package now.
  
  Release Date: October 22, 2003
  
  For more information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:

  119591 How to obtain Microsoft support files from online services

  Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

If you configure SMS so that SMS operates beyond typical boundaries, many files may appear on an SMS site server at unexpected times. For example, if you implement 50 software metering rules at the same time to 8,000 clients, SMS can generate 400,000 status messages. How fast SMS and the antivirus software can process these status messages is affected by factors such as CPU speed and disk I/O. If the antivirus software Real-Time monitoring process uses more than 70 percent of the CPU for extended periods, a file backlog will likely occur.

The SMS_Executive service may stop responding to some threads. These include the following threads:

• SMS_Discovery_Data_Manager
• SMS_Status_Manager
• SMS_Replication_Manager
• SMS_Despooler
• SMS_Data_Loader
• SMS_Collection_Evaluator

If you experience the behavior described in this ariticle, use one or more of the following methods to reduce the file backlog:

• Exclude the SMS\Inboxes\SMS_Executive Thread Name directory or the SMS_CCM\ServiceData directory from the virus-scanning process
• Make sure that the antivirus software is not configure for Real-Time monitoring.
• Remove the antivirus software, and then restart the server so that any remaining traces are unloaded and removed from memory.

Note If you exclude the SMS\Inboxes directory from virus scanning or remove the antivirus software, you may make the site server and all clients vulnerable to potential virus risks. The client base component files reside in the SMS\Inboxes directory. Therefore, use these options only as a short-term troubleshooting step and not as a solution for this behavior. For more information, click the following article number to view the article in the Microsoft Knowledge Base: