How to collect data to analyze a scan result from Symantec Protection Engine 7.0.x and 7.5.x.

Products

• Protection Engine for Cloud Services

Issue/Introduction

Symantec Scan Engine / Protection Engine returns a scan result that is unexpected. You seek to collect detailed data to have Technical Support analyze the product behavior.

Resolution

Enable the ScanFileSave feature to collect all transaction data. Note, this should only be used for a short period of time for a specific case, as enabling this feature adds significant system overhead.

To enable ScanFileSave feature for Windows

    1. Login with an account that has local Administrator rights
    2. At the Command Prompt (CMD), change directory by typing the following:
    cd "\Program Files\Symantec\Scan Engine"
    3. Prompt java to make a settings change in Scan Engine / Protection Engine by typing the following:
    java -jar xmlmodifier.jar -s /configuration/ScanFileSave/ScanFileSaveSetting/@value ALL category3.xml
    4. Make the change effective by restarting the Scan Engine / Protection Engine service in the Windows Service console.

    A new directory will be created under "\Program Files\Symantec\Scan Engine". The new folder will have a name which matches the following format:
    scanfilesave-yyymmdd-time.

To disable ScanFileSave for Windows

    1. Login with an account that has local Administrator rights
    2. At the Command Prompt (CMD), change directory by typing the following:
    cd "\Program Files\Symantec\Scan Engine"
    3. Prompt java to make a settings change in Scan Engine / Protection Engine by typing the following:
    java -jar xmlmodifier.jar -s /configuration/ScanFileSave/ScanFileSaveSetting/@value OFF category3.xml
    4. Make the change effective by restarting the Scan Engine / Protection Engine service in the Windows Services console.

    Add the scanfilesave directory to a .zip archive and send it to support.

To enable ScanFileSave feature for Linux/Solaris

    1. At a shell prompt, obtain root credentials
    2. At the shell prompt, change directory by typing the following command:
    cd /opt/SYMCScan/bin
    3. Prompt java to make a settings change in Scan Engine / Protection Engine by typing the following:
    java -jar xmlmodifier.jar -s /configuration/ScanFileSave/ScanFileSaveSetting/@value ALL category3.xml
    4. Make the change effective by restarting the Scan Engine /Protection Engine daemon by typing:
    /etc/init.d/symcscan restart

    A new directory will be created. The new folder will have a name which matches the following format:
    scanfilesave-yyymmdd-time.

To disable ScanFileSave for Linux/Solaris

    1. At a shell prompt, obtain root credentials
    2. At the shell prompt, change directory by typing the following command:
    cd /opt/SYMCScan/bin
    3. Prompt java to make a settings change in Scan Engine / Protection Engine by typing the following:
    java -jar xmlmodifier.jar -s /configuration/ScanFileSave/ScanFileSaveSetting/@value OFF category3.xml
    4. Make the change effective by restarting the Scan Engine / Protection Engine daemon by typing:
    /etc/init.d/symcscan restart

    Add the scanfilesave directory to a .zip archive and send it to support.