Files being submitted to be scanned by 3rd party application failing due to returned File Attribute Violation error

Products

• Protection Engine for Cloud Services

Issue/Introduction

When certain compressed files are being submitted to be scanned by a 3rd party application (via ICAP) the SPE server was returning a warning indicating that the process didn't go through, or didn't succeed.

A look at the log entry on the SPE server at the same time the scan failed and registered a failure with the application-- a warning was found in the SPE logs in reference to the file name under the "File Policy (Maximum Size)"  column.

File Attribute Violation

Environment

Release : 8.2.2

 

Cause

The file size was considered too large to pass the MaxFileSize setting without adjusting it.

Resolution

The size of the file was 1.9GB so running the following command on the SPE server corrected the problem by adjusting the maximum file size allowed to 2GB

 

Linux: From /opt/SYMCScan/bin

./xmlmodifier -s //filtering/FileAttribute/MaxFileSize/@value 2097152000  filtering.xml

 

Windows: ".\Program Files\Symantec\Scan Engine\

xmlmodifier -s //filtering/FileAttribute/MaxFileSize/@value 2097152000  filtering.xml