Excluding large files from scanning to improve scan and network performance in Scan Engine 5.2.5 and later and Symantec Protection Engine 7.x
|Article:TECH170128|||||Created: 2011-09-22|||||Updated: 2014-07-17|||||Article URL http://www.symantec.com/docs/TECH170128|
You notice performance degredation when scanning large files. You are looking for steps to mitigate or resolve this issue and wish to exclude files over a certain size from scanning.
Introduced in Scan Engine 5.2.5 was the ability to exclude files from scanning based on the FileSizeScanThreshold parameter. Files greater than the size (in bytes) set for this parameter will be excluded from scanning and will not be copied to the Scan Engine server.
Please follow the steps below to enable the FileSizeScanThreshold parameter:
- Stop the Scan Engine or Symantec Protection Engine service
- Open a command prompt on the main Scan Engine installation folder
- Type the following command:
java -jar xmlmodifier.jar -s /filtering/FileAttribute/FileSizeScanThreshold/@value <valueInBytes> category3.xml
- Start the Scan Engine or Symantec Protection Engine service
Notes: Starting in Scan Engine 5.2.13 the location of this File Attribute has been moved from "category3.xml" to "filtering.xml" . For Scan Engine 5.2.13 and above please make the correct change to the above command line.
- This parameter is applicable in RPC and ICAP
- The value is in bytes
- If file size is greater than configured threshold, then Scan Engine will return a clean verdict, an information event will record that the file was greater in size than the File Size Scan Threshold
- In the event that a file is copied locally prior to the FileSizeScanThreshold being checked please contact technical support. This is a known issue in certain conditions. This will be resolved in SSE 5.2.13
Article URL http://www.symantec.com/docs/TECH170128