ProxyAV reports Alerts with "Maximum file size exceeded" and "File has been dropped" messages, but ProxySG continues to serve the files.
Why does the ProxySG serve an object even though the ProxyAV reports that it dropped the object because Max file size limit was exceeded?
If the "Error handling" setting on your ICAP response service object is set to "Continue without further ICAP response processing", even though the AV reports the Alert with "Maximum file size exceeded" and "File has been dropped" messages, the ProxySG will continue to serve the file.
This is an expected behavior as the ProxySG does as it configured. To prevent this from happening, set your ICAP response modification rule to fail closed as show below.
Imported Document ID: 000016309
Subscribing will provide email updates when this Article is updated. Login is required.