File Sight reporting that buffers are not large enough

Doug 1126
Viewed 0

I've seen two messages about buffers in PA File Sight:

File I/O activity is heavy enough that the driver buffers are not large enough to keep up.

File I/O activity is heavy enough that the internal buffers are not large enough to keep up. Increase buffer sizes or perhaps watch less

driver file-sight
1 Answers

There are three options to deal with this one:

  1. Ignore busy process(es). Note that this must be done in all monitors on that server (if all monitors ignore a process, it will be ignored at the driver level. If any monitor needs to see data from that process, then the driver needs to deliver it for further filtering). (Note that v4.2 has more information in the alert about busy process(es)

  2. Watch less file activity. In particular, if you don't need to know about file reads, don't watch them as most file activities are reads.

  3. Increase the number of buffers available. It's important to look at the error message to see if driver buffers or internal buffers need to be increased.

To increase driver buffers:

HKLM\SYSTEM\CurrentControlSet\servicesFileSightMF

MaxRecords is the value to change.

To increase internal buffers, go to:

HKLM\software\PAFileSight (or HKLM\software\Wow6432Node\PAFileSight)

FileSightMaxFileInfoMapSize is the value to change.

For either value, doubling would be a good initial start. The PA File Sight service needs to be restarted after making a change to either value.

Doug1126
Related