A third party application is receiving a large number of ICAP 500 server errors from SPE

Products

• Protection Engine for Cloud Services
• Protection Engine for NAS

Issue/Introduction

A third party application submitting scan request to a Protection Engine server occasionally logs hundreds of errors similar to the following:

2024-05-22T00:06:00,852 [EventQueueWorker2-ThreadPool-261] ERROR com.example.server.icap.common.ICAPUtils - Unexpected code returned from ICAP: 500 Server Error

There are no errors in the SPE logs, but there may be a large number of "Encrypted container" warnings-- all referencing the same file:   /path/filename.zip.filepart 

Environment

Protection Engine with ICAP enabled

Cause

A large zip file was in the process of being downloaded and, with every change to the downloading file being written to disk, that change was submitted to SPE to be scanned even though the file was still incomplete.

Resolution

The application should be modified to not submit incomplete/transitory files to be scanned until they are a fully formed file.