How to collect data to analyze a scan result from Symantec Scan Engine 5.x and Symantec Protection Engine 7.0.x.

Article:TECH84224  |  Created: 2006-01-09  |  Updated: 2014-07-21  |  Article URL http://www.symantec.com/docs/TECH84224
Article Type
Technical Solution


Issue



Symantec Scan Engine / Protection Engine returns a scan result that is unexpected. You seek to collect detailed data to have Technical Support analyze the product behavior.


Solution



Enable the ScanFileSave feature to collect all transaction data. Note, this should only be used for a short period of time for a specific case, as enabling this feature adds signficant system overhead.

For enabling ScanFileSave feature on version 7.5.x or higher, steps can be found under KB TECH223047.

To enable ScanFileSave feature for Windows

    1. Login with an account that has local Administrator rights
    2. At the cmd command prompt, change directory by typing the following:
    cd "\Program Files\Symantec\Scan Engine"
    3. Prompt java to make a settings change in Scan Engine / Protection Engine by typing the following:
    java -jar xmlmodifier.jar -s /configuration/ScanFileSave/ScanFileSaveSetting/@value ALL category3.xml
    4. Make the change effective by restarting the Scan Engine / Protection Engine service in the Windows Service console.

    A new directory will be created under "\Program Files\Symantec\Scan Engine". The new folder will have a name which matches the following format:
    scanfilesave-yyymmdd-time.


To disable ScanFileSave for Windows

    1. Login with an account that has local Administrator rights
    2. At the cmd command prompt, change directory by typing the following:
    cd "\Program Files\Symantec\Scan Engine"
    3. Prompt java to make a settings change in Scan Engine / Protection Engine by typing the following:
    java -jar xmlmodifier.jar -s /configuration/ScanFileSave/ScanFileSaveSetting/@value OFF category3.xml
    4. Make the change effective by restarting the Scan Engine / Protection Engine service in the Windows Services console.

    Add the scanfilesave directory to a .zip archive and send it to support.



To enable ScanFileSave feature for Linux/Solaris

    1. At a shell prompt, obtain root credentials
    2. At the shell prompt, change directory by typing the following command:
    cd /opt/SYMCScan/bin
    3. Prompt java to make a settings change in Scan Engine / Protection Engine by typing the following:
    java -jar xmlmodifier.jar -s /configuration/ScanFileSave/ScanFileSaveSetting/@value ALL category3.xml
    4. Make the change effective by restarting the Scan Engine /Protection Engine daemon by typing:
    /etc/init.d/symcscan restart

    A new directory will be created. The new folder will have a name which matches the following format:
    scanfilesave-yyymmdd-time.



To disable ScanFileSave for Linux/Solaris

    1. At a shell prompt, obtain root credentials
    2. At the shell prompt, change directory by typing the following command:
    cd /opt/SYMCScan/bin
    3. Prompt java to make a settings change in Scan Engine / Protection Engine by typing the following:
    java -jar xmlmodifier.jar -s /configuration/ScanFileSave/ScanFileSaveSetting/@value OFF category3.xml
    4. Make the change effective by restarting the Scan Engine / Protection Engine daemon by typing:
    /etc/init.d/symcscan restart

    Add the scanfilesave directory to a .zip archive and send it to support.


Legacy ID



2006020915252154


Article URL http://www.symantec.com/docs/TECH84224


Terms of use for this information are found in Legal Notices