SPE Scan requests fail

Products

• Protection Engine for Cloud Services
• Protection Engine for NAS

Issue/Introduction

Some scans with the Symantec Protection Engine (SPE) are rejected.  While reviewing the SSE########.logs you notice a large number of the following warning:

Scan request rejected

When using SSECLS to perform a test scan you note the following error:

Error: Server too busy.

When using an ICAP client to send requests to SPE, an HTTP 506 will be returned.

 

Environment

SPE 9.x

Cause

The SPE is working as designed and is rejecting requests as the queue is full.

Resolution

There are several potential solutions to this issue including;

• If there are available cores, increase the Min/Max threads (please see the document linked in "Additional Information" for how to change the Min/MaxThreads).
• Add 1 or more additional SPEs to accommodate the additional load.
• Increase the queue (LoadMaximumQueuedClients).  Note: Increasing the queue size may lead to longer scan times. (please see the document linked in "Additional Information" for how to change the LoadMaximumQueuedClients)

Additional Information

Resources
https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/symantec-protection-engine/9-3-0/Command-line-Reference-Guide/resources-v131945551-d4995e40489.html

About available threads for scanning
https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/symantec-protection-engine/9-3-0/Configuring-and-Monitoring/about-available-threads-for-scanning-v128532502-d4995e12840.html#v128532502