Protection Engine SDK information pertaining to timeouts for Java applications

Products

• Protection Engine for Cloud Services

Issue/Introduction

In the SPE installation folders, when extracted, there are examples for Java

..\SPE_NAS\Symantec_Protection_Engine_SDK\Java\Example

On line 565 when ScanEngine is declared there are two values passed in as defaults of 300000 ms (30 seconds)  What do these mean?

     ScanEngine scanEngine = ScanEngine.createScanEngine(scanEnginesForScanning,300000,300000);
                        if(isExtendedAPI == 0)
                        {
                            FileScanRequest fileScanReq = scanEngine.createFileScanRequest(fileForScan, scPolicy);
                            Result result = fileScanReq.scanFile();
                            printResult(result, false);

 

Resolution

The values are for failRetryTime and readWriteTime respectively.,

 

If programmers, writing their own application, do not pass in values for failRetryTime and readWriteTime then the default for failRetryTime is 1 second and default for readWriteTime is 3 seconds (which may be too low).

 

The SDK expects the value for these fields to be provided in milliseconds.

 

To explain further:

 

failRetryTime is to check if the client fails to connect to a Symantec Protection Engine. It waits for configured time before trying to connect to that server again. The client will retry for 5 times before marking the SPE as unhealthy. 

 

readWriteTime is if, after configured time, no response is received from Symantec Protection Engine (when data is being transmitted to Symantec Protection Engine), 

or if the transmission of data does not complete (when data is being received from Symantec Protection Engine), returns an error message

 

To identify the right value for readWriteTime, you should enable verbose logging in SPE by following the below link. Then by restarting the Symantec Protection Engine service in Windows (/etc/init.d/symcscan restart in Linux):

 

https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/symantec-protection-engine/9-0-0/Command-line-Reference-Guide/logging-v131945591-d4995e40934.html

 

After that, configure a large value of 1 hr or 2 hours for readWriteTime. Then scan the large file and after the scan completes, run the logconverter tool on the SPE log file to check the "Scan Duration '' and "Connect Duration" value for those large files. The value you see in  "Connect Duration '' should be set as value for readWriteTime.