You notice performance degredation when scanning large files. You are looking for steps to mitigate or resolve this issue and wish to exclude files over a certain size from scanning.
Introduced in Scan Engine 5.2.5 and later versions (Symantec Protection Engine 7.x) was the ability to exclude files from scanning based on the FileSizeScanThreshold parameter. Files greater than the size (in bytes) set for this parameter will be excluded from scanning and will not be copied to the Scan Engine server.
Please follow the steps below to enable the FileSizeScanThreshold parameter:
Stop the Scan Engine or Symantec Protection Engine service
Open a command prompt on the main Scan Engine installation folder and browse to: [drive]\Program Files (x86)\Symantec\Scan Engine
Verify the version of java installed in your environment
Insert in quotes the full path where java can be found the following line: java -jar xmlmodifier.jar -s /filtering/FileAttribute/FileSizeScanThreshold/@value <valueInBytes> category3.xml
Start the Scan Engine or Symantec Protection Engine service
If version 5.2.12 and earlier with java version 6, the following is an example:
Notes: Starting in Scan Engine 5.2.13 and Symantec Protection Engine 7.x, the location of this File Attribute has been moved from "category3.xml" to "filtering.xml" . For Scan Engine 5.2.13 and above, please make the correct change to the above command line.
This parameter is applies to RPC and ICAP FILEMOD only (not other ICAP modes).
The value is in bytes
If file size is greater than configured threshold, then Scan Engine will return a clean verdict, an information event will record that the file was greater in size than the File Size Scan Threshold
In the event that a file is copied locally prior to the FileSizeScanThreshold being checked please contact technical support. This is a known issue in certain conditions. This will be resolved in SSE 5.2.13
Imported Document ID: TECH170128
Subscribing will provide email updates when this Article is updated. Login is required.