IMF Tune v6.1 - Forefront Protection 2010 for Exchange Support
IMF Tune Quarantine Performance Considerations
The IMF Tune Moderator/Reporting interface very often provides access to thousands of emails. At the same time new emails are being added to the backend database. This requires the system to be very responsive. Here are some recommendations on how to install and configure this component with performance in mind.
1. Background Information
The IMF Tune Moderator/Reporting interface is made up of:
The Quarantine system responsiveness is very dependent on the backend database performance. So here we focus on the MS SQL database. We start with some basic installation time considerations. Next we look at configuration settings that impact the volume of data the system has to handle.
2. Processing Power and Server Resources
Whenever discussing application performance, the server processing power and available resources are a good starting point.
The most common performance related problems our support investigates, very often concern relatively small organizations that try to run all their server applications on a single machine.
WinDeveloper recommends running the SQL database on a different server, other than the MS Exchange server where the IMF Tune filtering component is installed.
3. Moving the Quarantine Database to new Hardware
The long term solution to performance related problems is to make sure the Database has enough resources to handle the email load. This could mean that we have to move the Quarantine Database to a different server. For details on how to do this check the article Moving the Quarantine Database to New Hardware.
4. Reduce the Data Retention Time
IMF Tune provides the functionality to automatically purge old Quarantine and Reporting data. These settings have a significant impact on the amount of data the Quarantine system handles. For example, reducing the data retention from 30 days to 20 days we cut the data volume by a third.
This functionality is controlled through two edit boxes under Disk Maintenance | Archives/Quarantine.
Reducing this value reduces the number of days an email is available at the Moderator interface. So the administrator has fewer days for reviewing blocked emails.
Basically this value determines the number of days reporting information will cover. For example a chart showing the total number of blacklisted emails effectively shows the sums of all blacklist matches for the period of time configured here.
Considering the two settings together we can easily see why
Secondly we can see that
These two edit boxes give us the opportunity to control the data volume at the Database. We can reduce these until we reach a level that our current hardware is able to handle.
5. Reduce Storage of Reporting Data
Performance can be improved by reducing the amount of data collected. In this manner we reduce the SQL database load.
The IMF Tune web interface covers two functionality areas, Quarantine Moderation and Reporting.
By default IMF Tune is configured to store information on all processed emails for reporting purposes. This includes both spam and legitimate emails. Whereas information on spam emails is used for both the Quarantine and Reporting functionality, legitimate emails are mostly useful for Reporting purposes.
This functionality is controlled by the checkbox under Quarantine | Quarantine Database:
Clearing this checkbox, IMF Tune stops recording information on each email for reporting purposes. Thus less data is written to the SQL database.
Note: When the checkbox
Note: When the checkbox
6. Only Store Blocked Emails
The load on the SQL database can be reduced further by making sure that only blocked emails are recorded. The logic is similar to that discussed in the previous point but the settings involved are different.
IMF Tune allows us to select which emails to Quarantine based on the SCL rating. This is configured at the Archiving/Quarantine Category.
Here we create Archiving/Quarantine profiles. If we open an existing profile or create a new one we get the dialog that follows.
Here we find the checkbox:
When this checkbox is set, emails whose SCL match the profile are uploaded to the SQL database.
IMF Tune leaves us completely free when configuring the profile SCL set. Thus we can easily configure the system to upload legitimate emails to the database. This can be useful when fine tuning SCL thresholds for example. However, if in need to relieve the database from some load, it is good to keep the database for blocked emails exclusively.
Do this as follows:
Note: When the IMF Tune configuration is changed, any emails already uploaded to the database won't be immediately deleted. This data will be purged gradually as the information ages based on the setting:
7. IMF Tune Quarantine Database Purging
In this document we described configuration changes that allow us to reduce the amount of data uploaded to the Quarantine database. However as already highlighted IMF Tune won't immediately delete email information already accumulated at the database. To force an immediate database purge check IMF Tune Quarantine Database Purging.