You're using SSE 5.2.x with a NAS Filer using the RPC protocol, and you've noticed some performance degradation when scanning large non-container files. You're looking for steps to mitigate or resolve this issue.
With earlier Symantec Scan Engine versions, such as 5.1.x, the default value of FilerPerformanceThreshold is set to 64MB. Since the release of Scan Engine 5.2.2, the FilerPerformanceThreshold value is set by default to 0, which disables the feature. This means every file will be read into the Scan Engine temp folder before it is scanned.
Please follow the steps below to change the FilerPerformanceThreshold parameter in Scan Engine:
- Stop the Scan Engine service
- Open a command prompt and change directory to the Scan Engine program folder
- Type the following command:
java -jar xmlmodifier.jar -s /filtering/Container/FilerPerformanceThreshold/@value <size-in-bytes>
- Start the Scan Engine service
Notes: Starting in Scan Engine 5.2.13 and above, including Protection Engine 7.0, the location of this Container setting has been moved from "category3.xml" to "filtering.xml" . Please make the correct change to the above command.
- This parameter is applicable in RPC protocol only.
- If file size is greater than configured threshold, then the file is scanned in place by the Scan Engine. If the file size is less than the configured threshold the file is copied to the scanner prior to scanning.
- If this parameter is set to 0, then all files are locally copied and then scanned.
- Also note that if the Filer contains a lot of large Office documents, it would not be benefical to enable this feature. Performance gains with this feature are typically only seen when scanning large non-container files, or at least files the Scan Engine does not see as a container.