File Sight reporting that buffers are not large enough

There are three options to deal with this one:

1. Ignore busy process(es). Note that this must be done in all monitors on that server (if all monitors ignore a process, it will be ignored at the driver level. If any monitor needs to see data from that process, then the driver needs to deliver it for further filtering). (Note that v4.2 has more information in the alert about busy process(es)

2. Watch less file activity. In particular, if you don't need to know about file reads, don't watch them as most file activities are reads.

3. Increase the number of buffers available. It's important to look at the error message to see if driver buffers or internal buffers need to be increased.

To increase driver buffers:

HKLM\SYSTEM\CurrentControlSet\servicesFileSightMF

MaxRecords is the value to change.

To increase internal buffers, go to:

HKLM\software\PAFileSight (or HKLM\software\Wow6432Node\PAFileSight)

FileSightMaxFileInfoMapSize is the value to change.

For either value, doubling would be a good initial start. The PA File Sight service needs to be restarted after making a change to either value.