How to block or allow files when they exceed Maximum Extract size, Max Extract Time, or Max Container Depth in Protection Engine

Products

• Protection Engine for Cloud Services
• Protection for SharePoint Servers
• Protection Engine for NAS

Issue/Introduction

In the Symantec Protection Engine (SPE) V7.0.x and V7.5.x console you had a selection on the Policies->Filtering->Container Handling page

called "Allow access to the file and generate a log entry" .

SPE 7.0.x or 7.5.x Console

In Symantec Protection Engine (SPE) V7.9 there is NO GUI selection on the Policies->Filtering->Container Handling page to allow files if they exceed the maximum conditions.

SPE 7.9 Console

Resolution

SPE V7.0.x and V7.5.x

Allowing files that exceed maximum limits can also be set with xmlmodifier. In SPE V7.0.x and V7.5.x the syntax of the command is

xmlmodifier.exe -s /filtering/Container/LimitChoiceStop/@value 1/0 filtering.xml    1 indicates block, 0 indicates allow

The one command above blocks or allows files that exceed Maximum Extract size, Max Extract Time, or Max Container Depth.

SPE V7.9

Allowing files that exceed maximum limits must be set with xmlmodifier, and there is one xmlmodifier command for each maximum condition.

Note:  For the below commands  1 (default) indicates block and  0 indicates allow.

xmlmodifier.exe -s /filtering/Container/MaxExtractSize/@actionpolicy 1/0 filtering.xml    

xmlmodifier.exe -s /filtering/Container/MaxExtractTime/@actionpolicy 1/0 filtering.xml

xmlmodifier.exe -s /filtering/Container/MaxExtractDepth/@actionpolicy 1/0 filtering.xml

xmlmodifier.exe -s /filtering/Container/MaxCumulativeExtractSize/@actionpolicy 1/0 filtering.xml

 

The above xmlmodifier examples should be run in the directory where scan engine is installed and the xmlmodifier.exe command and xml files reside.   You will need to stop the Scan Engine service before running the above commands, and then start the service up again after the commands have executed.