Temp folder is filling up after Scan Engine 5.2.5 (or newer) for NAS and RPC Filers is installed

Products

• Protection Engine for Cloud Services
• Scan Engine
• Protection for SharePoint Servers
• Protection Engine for NAS

Issue/Introduction

Temp folder is filling up after Scan Engine 5.2.5 (or newer) for NAS and RPC Filers is installed

Symptoms
- Temp folder is filling up after Scan Engine 5.2.5 (or newer) for NAS and RPC Filers is installed

- The Scan Engine performance might be decreased

 

Cause

With earlier Scan Engine versions, such as 5.1.x, the default value of FilerPerformanceThreshold is set to 64MB. Since the release of Scan Engine 5.2.5, the FilerPerformanceThreshold value is set by default to 0, meaning that every file will be copied locally and then scanned rather than scanning the file over network.

Resolution

Please follow the steps below to change the FilerPerformanceThreshold parameter in Scan Engine:
 

1. Stop the Scan Engine service
2. Open a command prompt and change directory to the Scan Engine program folder
3. Type the following command:
   java -jar xmlmodifier.jar -s /filtering/Container/FilerPerformanceThreshold/@value <size-in-bytes> category3.xml
4. Start the Scan Engine service

Note:

Starting in Scan Engine 5.2.13 the location of this File Attribute has been moved from "category3.xml"  to "filtering.xml" . For Scan Engine 5.2.13 and above please make the correct change to the above command line.

• This parameter is applicable in RPC protocol only.
• If file size is greater than configured threshold, then the file is scanned in place by Scan Engine.  If the file size is less than the configured threshold, then the file is read into the Scan Engine temp folder before it is scanned. 
• If this parameter is set to 0, then all files are locally copied and then scanned.
• Also note that if the Filer contains a lot of large Office documents, it would not be beneficial to enable this feature.  Performance gains with this feature are typically only seen when scanning large non-container files, or at least files that Scan Engine does not see as a container. 
  
  Also Please make sure if you are using Symantec Endpoint Protection on Same server, make sure that you have disabled Network Scanning in Endpoint Protection.

In some cases increasing the temp drive space may be required as well.