After migrating scanning from an 8.0 or earlier Protection Engine scanner to an 8.1 Protection Engine scanner using the Protection Engine SDK, scans are returning 500 internal server error.

Products

• Protection Engine for Cloud Services
• Protection Engine for NAS

Issue/Introduction

After migrating scanning from an 8.0 or earlier Protection Engine scanner to an 8.1 Protection Engine scanner using the Protection Engine SDK, scans are returning 500 internal server error. In the Protection engine logs, the files returning errors are logged with error "Decomposer 22".

Environment

The connector sending scan requests is sending the requests to the url icap://<SPE ip address or hostname>/avscan.

Cause

The older ICAP scanning method "avscan" has been deprecated and no longer functions correctly with version 8.1 and later.  

Resolution

Use one of the following methods to invoke antivirus scanning with Protection engine via ICAP: SYMCScanResp-AV or SYMCScanRespEx-AV. 

Additional Information

For more details on the ICAP methods available and their usage and syntax, see Protection Engine for Cloud Services 8.2.2 Software Developer's Guide page 14 of the SPE_NAS_8_2_2_SDK_Guide PDF, section About ICAP services