Monitoring performance and health

You can monitor your Microsoft Forefront Protection 2010 for SharePoint (FPSP) environment by viewing statistics and health monitoring reports. In the Forefront Protection 2010 for SharePoint Administrator Console, click Monitoring and under Server Security Views, click Dashboard.

In the Server Security Views - Dashboard pane, you can view the following information:

The name of the computer running SharePoint.
Health monitors. You can monitor the health of your scan jobs, services, engines, and licensing.
Summary performance monitors. For each scan job type, there is a pie chart showing the number of scanned files that contained malware and the number of scanned files that matched each filter type (file and keyword). The total number of files scanned is also listed along with the date and time that the data was last refreshed.

Monitoring the health of your system

You can monitor the health of FPSP by viewing the health monitors at the top of the Dashboard. There are four types of health monitors:

Scan Jobs—Monitors the current state of your scan jobs.
Services—Monitors the current state of FPSP services.
Engines—Monitors the current state of your scan engines.
Licensing—Monitors the current state of your FPSP license.

Viewing health item details

Each of the monitors has an associated Show details link. To see the underlying details, click Show details. This displays summary icons and underlying details.

The summary icons are as follows:

Healthy—A green circle with a check mark. This indicates good health and that no action is required.
Warning—A yellow triangle with an exclamation mark. This indicates a less than ideal situation that likely bears close monitoring.
Error—A red circle with an "X". This indicates an error that may require fixing.
Unknown—A gray shield. This indicates that FPSP has not yet reached the scheduled health check interval, is not able to determine the current health, or that the item is not defined for your system. An event is generated as soon as FPSP determines the health status.

The underlying details are as follows:

Health Point—Tells you what is being monitored, for example Realtime scan SP processes.
Last Refresh—Tells you the last time the health point was checked.
Message—Tells you the current status of the health point being monitored, including information about any problems that the monitor encountered.

Note:
If FPSP either has not yet reached the scheduled health check interval or was not able to determine the current health of the health point, there is no message. A message is generated as soon as FPSP determines the health status.

About the health points

Note:
To ensure that you are viewing the most current data, under the Actions section, you can click Refresh

These are the scan job health points that FPSP monitors:

Health Point	Meaning
Selected realtime engine initialization	Monitors whether all engines selected for the realtime scan have been initialized.
Realtime scan SP	Monitors whether the realtime scan has been enabled.
Realtime scan SP processes	Monitors whether the realtime scan processes are running normally.
SharePoint service hooked	Monitors whether the SharePoint service is running and the Forefront VSAPI Library is registered.
Scheduled scan SP processes	Monitors whether the scheduled scan processes are running normally.
Selected SP scheduled engine initialization	Monitors whether all engines selected for the scheduled scan have been initialized

These are the services health points that FPSP monitors:

Health Point	Meaning
Available disk space	Monitors the amount of disk space remaining.
Eventing service	Monitors whether the eventing service is functioning.
E-mail pickup service	Monitors whether the mail pickup service is functioning.
FPSP controller service	Monitors the FPSP controller service.

These are the engines health points that FPSP monitors:

Health Point	Meaning
All engine updates enabled	Monitors whether the engines that were selected for updating were successfully updated.
Selected engines updated	Monitors whether the engines that were selected for scan jobs were also selected for updates.
Selected engines update period	Monitors whether the engines that were selected for updating were updated recently.

This is the licensing health point that FPSP monitors:

Health Point	Meaning
License status	Monitors whether your license is still valid, is nearing expiration, or has expired.

Viewing engine summary information

You can monitor engine summary information for FPSP by viewing the Engines health monitor, and then selecting Engine Summary.

In the Engine Summary dialog box, you can view the following information about engine and definition updates:

Engine—The scan engine, for example Microsoft Antimalware Engine.
In Use—Indicates whether the engine is in use with a scan job.
Updates Enabled—Indicates whether updating is enabled (Yes) or disabled (No) for the engine.
Engine Version—The version of the engine.
Definition Version—The version of the malware definition files currently in use by the engine. (This data may not be available for every engine.)
Last Update—The date and time of the last successful or failed update of the engine or definition files. Failed updates appear in red text.
Last Check—The date and time of the last check made for a new engine or definition update.

Note:
You can sort any of the columns alphabetically by clicking the column's heading. For information about changing how the engine and definition files are updated, see Configuring engine and definition updates.

Customizing the Dashboard view

You can customize which items appear on the Server Security Views – Dashboard pane.

To customize the Dashboard view

In the Actions section, click Control Gallery.
In the Control Gallery dialog box, select which items you want to appear on the Server Security Views – Dashboard pane. A check mark next to the item indicates that it is displayed; no check mark indicates that it is hidden (you can also click the red X box, associated with each item, to remove it from the view).

By default, the Scheduled Scan Summary, On-Demand Scan Summary, Health Monitors, and Realtime Scan Summary are displayed.
Click Exit to close the Control Gallery dialog box.

Monitoring performance by viewing statistics

You can monitor the performance of FPSP by viewing the statistics on the Dashboard. If you need the statistics broken down further, you can view detailed malware statistics and detailed filtering statistics.

Viewing detailed malware statistics

To see statistics about files with malware, click Monitoring and under Server Security Views, click Malware Details. In the Server Security Views - Malware Details pane, the details are broken out by scan job type: realtime, on-demand, and scheduled. You can sort any of the columns by clicking its heading. To ensure that you are viewing the most current data, under the Actions section, you can click Refresh.

The following details are given:

Files detected—The total number of files that contained malware.
Files blocked—The total number of malicious files that were blocked. This data is only for realtime scans.
Files cleaned—The total number of malicious files that were cleaned due to malware detections.
Files deleted—The total number of files that were replaced with deletion text due to malware detections. This data is only for scheduled and on-demand scans.
Files skipped (detected only)—The total number of malicious files that were detected and logged as containing malware, but with no other action taken.
Files quarantined—The total number of malicious files that were quarantined due to malware detections.

Viewing detailed filtering statistics

To see statistics about files that matched filters, click Monitoring and under Server Security Views, click Filtering Details. In the Server Security Views - Filtering Details pane, the details for file filter matches and keyword filter matches are broken out by scan job type: realtime, on-demand, and scheduled. You can sort any of the columns by clicking its heading. To ensure that you are viewing the most current data, under the Actions section, you can click Refresh.

The following details are given:

Files detected—The total number of files that matched filters.
Files blocked—The total number of files blocked due to filter matches. This data only applies to realtime scans.
Files deleted—The total number of files deleted and replaced with deletion text due to filter matches. This data only applies to scheduled and on-demand scans.
Files skipped (detected only)—The total number of files detected and logged due to filter matches, with no other action taken.
Files quarantined—The total number of filtered files quarantined due to filter matches.

Resetting statistics data

You can reset malware and filtering statistics in order to begin a fresh count.

In the Server Security Views - Malware Details pane or in the Server Security Views - Filtering Details pane, in the Actions section, click the action to Clear Realtime Scan Statistics, Clear Scheduled Scan Statistics, or Clear On-Demand Scan Statistics. Regardless of which pane you are in, this clears the statistics for both malware and filtering.

Clicking these actions clears all malware and filtering data for the selected scan job. Depending on which Action option you selected, the statistics for the Dashboard and the associated details reports (Malware Details and Filtering Details) are reset to zero.
To reset all statistics (malware and filtering) for all scan jobs, in the Server Security Views - Dashboard pane, in the Actions section, click the action to Clear All Statistics.