Will Symantec Protection Engine scan a zero byte file?

Products

• Protection Engine for Cloud Services
• Protection Engine for NAS

Issue/Introduction

The question is occasionally asked: Will Symantec Protection Engine (SPE) scan a zero byte file and, if so, what will the result be?

Environment

Release : 9.1, 9.2x

Resolution

In version 9.1 and prior-- SPE will scan a zero byte file if it is passed in via a scan request.  However, when it detects that there is no content in the file it knows that there really isn't much to do and will return a "clean" verdict. 

 

Introduced in SPE 9.2 and later a feature was added into the REST API service to be configurable-- whether it will send a zero byte file to be scanned or reject it.

• Add the following line to the application.properties file and set the value to either true or false depending on how zero byte files are to be handled.
  
  service.sperestapi.scanning.scan.zero.bytes.files=true/false

• Restart the RestAPI service

 

The application.properties file will be in one of the following locations depending on operating system

Linux:  /opt/SYMCScan/RestAPI

Windows:  "C:\Program Files\Symantec\Scan Engine\RestAPI"

Note: This setting only affects scan requests submitted via REST API calls, not standard ICAP.