Scan errors are ingnored in SPE 9.3

Products

• Protection Engine for Cloud Services
• Protection Engine for NAS

Issue/Introduction

After upgrading to Symantec Protection Engine (SPE) 9.3 you observe a number of "Ignore Scan Error" entries with the SSE########.log file.  Despite these entries, your ICAP/RestAPI/RPC client is not reporting any scan errors.

Environment

SPE 9.3 or newer

Cause

SPE 9.3 includes a new feature called "IgnoreScanErrors."  This feature prevents SPE from returning an error message to the client if an internal scan error is detected.  This feature is enabled by default. 

Resolution

No action is required as this behavior is by design and is expected in SPE versions 9.3. 

To revert to the legacy behavior:

1. Download the category3.xml attached to this KB
2. Change the line
   

   <IgnoreScanErrors enabled="true">

   
   to
   

   <IgnoreScanErrors enabled="false">

3. Save and place the category3.xml in the <SPE_INSTALL_FOLDER>
   • Windows (default)
     C:\Program Files\Symantec\Scan Engine
   • Linux (default)
     /opt/SYMCScan/bin
4. Restart the SPE service:
   • Windows:
     

     net stop symcscan
     net start symcscan

   • Linux:
     

     /etc/init.d/symcscan restart

To ignore all but specific errors:

1. Download the category3.xml attached to this KB
2. Add the line <item value="-1"/> to between the <items></items> tags of the scan error you wish to see (the example below will cause SPE to return Decomposer errors when they are encountered):
   

   ...
                           <DecomposerScanner>
                                   <items>
                                           <item value="-1"/>
                                   </items>
                           </DecomposerScanner>
   ...

3. Save and place the category3.xml in the <SPE_INSTALL_FOLDER>
   • Windows (default)
     C:\Program Files\Symantec\Scan Engine
   • Linux (default)
     /opt/SYMCScan/bin
4. Restart the SPE service:
   • Windows:
     

     net stop symcscan
     net start symcscan

   • Linux:

     /etc/init.d/symcscan restart