WARNING: HTTP header count is over the limit! Message will be dropped warnings reported in FileReader logs

Products

• Data Loss Prevention Network Monitor and Prevent for Email and Web
• Data Loss Prevention Network Prevent for Web Virtual Appliance

Issue/Introduction

You are seeing "WARNING: HTTP header count is over the limit! Message will be dropped" warnings reported in FileReader logs on your Network Prevent for Web.

Environment

15.X

16.X

Cause

Network Prevent for Web is receiving ICAP-encapsulate packets where there are more header lines than specified under L7.MAX_NUM_HEADERS advanced setting. The purpose of limiting the count is to prevent a transfer agent from timing out waiting on content extraction which is 75 percent of the time spent on a detection message.

 

 

 

 

Resolution

1. Review ICAP details to see how many header lines are coming in a single ICAP.

2. Adjust L7.MAX_NUM_HEADERS setting according to findings.

• If concerned about bumping up the setting, discuss with support before changing.