Hey People,

Yes, we're still using FCS (I know it EOLs in a couple of months, but our Ops team haven't gotten around to a replacement yet...), but I'm finding on my Server 2012R2 servers, that it's ignoring the Folder and Process exclusion lists.

More specifically:

FCS Client v1.5.1996.0, Engine v1.1.11602.0

Windows Server 2012R2 patched up to April 2015.

Also running SharePoint 2013, patched up to April 2015 CU, this is a two server farm, with this server being the "Application" server, the other is the WFE.

All runing under VMWare.

We found that during SharePoint crawls, FCS would go nuts, using about 30-40% of total CPU (dual core), which caused massive delays in crawl times and seemed to impact on WFE performance too (suspect delays in App server performance caused delays in service requests by WFE).  I've used Sysinternals ProcMon to determine that the FCS process is indeed still scanning the excluded locations.

So I added the standard SharePoint folders to the FCS exclusion list and restarted the FCS services, but no change.
So I added the SharePoint searh processes to the exclusion list and restarted the FCS services, but no change.
So I rebooted the server, but no change.

Microsoft have quite a long list of things to exclude, but until I can get any exclusions working, there's no point in adding more.

Is anyone else seeing this?
Has anyone come up with a solution?

I don't really want to turn FCS off, but the performance difference is night-and-day!

Thanks
Craig

• Edited by Craig Humphrey Tuesday, May 12, 2015 1:54 AM

Hi,

How do you confirm the exclusions not work?

Best Regards,

Joyce

Hey Joyce,

Thanks for responding.
As I said in my original post, I've configured the exclusions in the FCS UI:

But I'm still seeing FCS touching the excluded files, thanks to ProcMon:

Does that help?

Thanks
Craig

Hi,

Have you checked if the exclusion paths list in the client registry? The following list the registries path.

https://technet.microsoft.com/en-us/library/bb418808.aspx?f=255&MSPPError=-2147217396

Please also check MPLog-daterange.log.

Best Regards,

Joyce

Thanks Joyce,

yes, the registry keys appear to be correct (including a folder I've since removed):

And processes:

However I've been unable to locate the MPLog-*.log files.  I thought they would be in C:\Program Files\Microsoft Forefront\Client Security\Client\Logs or c:\windows\temp but they are not.  Is there another location I should be looking? (Note: I did a search on c: for MPLog*.log but it didn't find anything)

Thanks
Craig

We've now upgraded to System Center End Point Protection:

Antimalware Client Version: 4.3.220.0
Engine Version: 1.1.11804.0
Antivirus definition: 1.201.1280.0
Antispyware definition: 1.201.1280.0
Network Inspection System Engine Version: 2.1.11804.0
Network Inspection System Definition Version: 115.3.0.0

However we still have the same problem. I've encouraged our operations team to raise a support call with Microsoft.