Excluding large files from scanning to improve scan and network performance in Scan Engine 5.2.5 and later and Symantec Protection Engine 7.x

Article:TECH170128  |  Created: 2011-09-22  |  Updated: 2014-08-28  |  Article URL http://www.symantec.com/docs/TECH170128
Article Type
Technical Solution


You notice performance degredation when scanning large files. You are looking for steps to mitigate or resolve this issue and wish to exclude files over a certain size from scanning.


Introduced in Scan Engine 5.2.5 and later versions (Symantec Protection Engine 7.x) was the ability to exclude files from scanning based on the FileSizeScanThreshold parameter. Files greater than the size (in bytes) set for this parameter will be excluded from scanning and will not be copied to the Scan Engine server.


 Please follow the steps below to enable the FileSizeScanThreshold parameter:

  1. Stop the Scan Engine or Symantec Protection Engine service
  2. Open a command prompt on the main Scan Engine installation folder and browse to: [drive]\Program Files (x86)\Symantec\Scan Engine
  3. Verify the version of java installed in your environment
  4. Insert in quotes the full path where java can be found the following line:
    java -jar xmlmodifier.jar -s /filtering/FileAttribute/FileSizeScanThreshold/@value <valueInBytes> category3.xml
  5. Start the Scan Engine or Symantec Protection Engine service

If version 5.2.12 and earlier with java version 6, the following is an example:

"[drive]:\Program Files (x86)\Java\jre6\bin\java" -jar xmlmodifier.jar -s 
/filtering/FileAttribute/FileSizeScanThreshold/@value 1073741824 

 If version 5.2.13 or 7.x and later and java version 6 is installed, the following is an example:

"[drive]:\Program Files (x86)\Java\jre6\bin\java" -jar xmlmodifier.jar -s 
/filtering/FileAttribute/FileSizeScanThreshold/@value <bytes> 

Notes: Starting in Scan Engine 5.2.13 and Symantec Protection Engine 7.x,  the location of this File Attribute has been moved from "category3.xml"  to "filtering.xml" . For Scan Engine 5.2.13 and above, please make the correct change to the above command line.

  • This parameter is applies to RPC and ICAP FILEMOD only (not other ICAP modes).
  • The value is in  bytes
  • If file size is greater than configured threshold, then Scan Engine will return a clean verdict, an information event will record that the file was greater in size than the File Size Scan Threshold
  • In the event that a file is copied locally prior to the FileSizeScanThreshold being checked please contact technical support. This is a known issue in certain conditions. This will be resolved in SSE 5.2.13 


Supplemental Materials




Article URL http://www.symantec.com/docs/TECH170128

Terms of use for this information are found in Legal Notices