ForeFront for SharePoint High Memory Utilization

At a client of mine today, who has a robust FSSP environment, similar to the larger one I wrote about in this MSDN article:

or if you are just interested in the specific image:,office.12).gif

was experiencing an abnormal amount of memory utilization on the WFE’s I had built for them. While they wanted a quick fix, it is important to remember that the scanning processes of FSSP will cause memory consumption depending on how you balance the engines being used. Forefront uses in-memory scanning (FSCRealtimeScanner.exe) and up to 5 scan engines can be employed so each scan process will load the engines that you have enabled under SETTINGS>Anti Virus.

For each of the scanning processes ~ 200-300MB RAM will generally be consumed depending the file being processed since the file being scanned is loaded into memory. Thus, if a scan is being executed on a file that is 200 MB and further 200MB RAM utilized. Once the scan is complete, this memory will return to the available pool.

All this being said, explicit reduction of processes spawned is controllable by modifying the RealtimeProcessCount registry value (HKLM\SOFTWARE\Wow6432Node\Microsoft\Forefront Server Security\SharePoint), which would require restarting FSSP and SharePoint services, however this should be approached with caution since having several real-time processes allow FSSP to scan more than one file, thus avoiding scan-related bottlenecks.

The only recommendation that can be made is a review of the memory consumption to establish whether the memory consumption is normal, and thus requires expanding the available RAM or whether there is a separate problem.