sir,
can u please define the below message. how i can troubleshoot this error .
There was an error running content update(Insight) Date/time of event = 2014-09-02 21:29:26 Event Severity Level = Error Insight Content Name = Insight symVT Content Error Message = ID-55 Update Method = LiveUpdate Symantec Protection Engine IP address = 192.xxx.xxx.xxx Symantec Protection Engine Port number
We are currently evaluating Symantec Protection Engine for uploading documents. We are testing this in Windows 2008 server using WebServices.
We are getting "LICENSE_NA" as the response even for EICAR file. We also verified the connection status and it seems it is fine. We are getting Connection status as "ERR_SUCCESSFUL_CON".
Is this really a limitation with the Trail version or are we missing any configuration?
I am having some issues implementing the file scanner with the Protection Engine for Cloud Services. We are trying out this product to use in a web application to scan documents uploaded by our users. I installed the 30 day trial of the Protection Engine onto one of our local servers here without too much issue.
Now that the service is running, I am attempting to create a simple C# application to send a byte array to the engine to scan and get a response back from our server letting me know if the document came back clean or if it is considered a threat. I have read through the documentation that I could find about the implementation of such an application and am still coming up short of a solution. I have also looked through the example code provided in the SDK for implementing the file scanner but the example seems to be built to show all of the options available for configuration of the service, when I only need to know how to use the File Stream Scanner.
If anyone can provide a code snippet, preferrably in C# (C or Java are fine as well), that gives me the ability to simply set my server IP, port number, and byte array and will send the file to the Protection Engine to scan, I would be very thankful!
If any additional information is needed, please do not hesitate to ask!
Thanks in advance,
Joe
[EDIT]:
I was able to finally figure out how to interface with the service to send files to scan, but I'm now having the same issue as the last post on this forum where the EICAR file I send to the server is returning a value of "LICENSE_NA". http://pastebin.com/BXHFC1ii <---This is the snippet that I currently have implemented that returns the "LICENSE_NA" error code.
I just installed the trial version of Symantec Protection Engine 7.5 on Windows 2012 R2 Server and trying to use the sample C# code provided with the SDK.
When I tried to scan Eicar.com file i am getting following output :
----------------------------------------------------------------------
Scanning file ........................................................
----------------------------------------------------------------------
Results ..............................................................
----------------------------------------------------------------------
File Scanned : C:\Users\Administrator\Desktop\eica
r.com
Scan Policy : DEFAULT
File Status : LICENSE_NA
Total Infection : 0
Definition Date : 10/21/2013 12:00:00 AM
Definition Rev Number : 001
--------------------------------------------------------------------------
Connection Details ......................................................
--------------------------------------------------------------------------
127.0.0.1
1344
ERR_SUCCESSFUL_CONN
FYI, service is running
Do i need a license to run trial? If so how i can get it or any other clue?
I saw another post with similar error but without any resolution.
Thanks,
Jubayer
Hi,
I am evaluating Protection Engine for Cloud Services 7.5 features using trail version.
When I am trying to scan password procted document using this trial version Protection Engine returns with CLEAN file status.
As the document is password protected, Scan Engine can not have access to this document's content.
In this case, how come it returns with CLEAN status??
Hello,
I am evaluating Protection Engine for Cloud Services 7.5 features using trail version. I am using java API (SymJavaAPI.jar) to scan files.
I am randomly getting 'Unable to open a stream to recieve the data from the server' while scanning files specially with large Files.
Any help would be appreciated !!
Hi,
I have gone through SPE 7.5 implementation guide which says
"The maximum top-level container file size that you can specify in SPE for tar, rar,
and zip containers is 30GB. For other containers, you
can specify a maximum top-level container file size of 2 GB".
Does SPE consider pdf file format in container other than tar, rar and zip containers??
I am not able to scan PDF file of size 3GB.
Any help would be appreciated..
Thanks.
Jignesh
I have installed a trial version of SCE 7.5 using the system requirements and cannot start the symcscan.exe service.
Faulting application name: symcscan.exe, version: 7.5.0.34, time stamp: 0x52ea3cb7
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0x4f4
Faulting application start time: 0x01cffd236b7396e0
Faulting application path: C:\Program Files (x86)\Symantec\Scan Engine\symcscan.exe
Faulting module path: unknown
Report Id: a929a7ae-6916-11e4-80c0-0050568540d5
Faulting package full name:
Faulting package-relative application ID:
Any ideas?
Hi,
I am evaluating SPE 7.5 using its trialware.
If SPE and client application are on different machines and files to be scanned are in a shared folder of client application then
will SPE use its own CPU or will it use client application's CPU ??
Thanks
Jignesh
Hi,
I am scanning zip file of size 3 GB. There are two pdf files inside this zip file. Both pdf files are less than 2 GB.
While scanning this file I am getting "INTERNAL_SERVER_ERROR" as file status.
I am not getting any container policy violation error for this.
As per documentation SPE should scan this zip file.
Any help would be appreciated.
Thanks..
Jignesh
Hi,
I am evaluating SPE 7.5 features using its trialware.
I am using Java API for this.
I am getting "Unable to open a stream to recieve the data from the server" while sending multiple CONCURRENT requests to SPE.
I configured Max Thread Number to 100 from Admin UI console. Created 100 threads (each thread will scan 28KB.dot file) from java application. But out of these 100 threads only 70 threads scanned file successfully. Rest of the threads gave above error.
readWriteTime=1000000000
SocketTimeOut - 5 min
Any Help would be appreciated.
Thanks.
Jignesh
Hi,
I am evaluating SPE 7.5 features using its trialware .
What should be the readwritetime value if files to be scanned varies from small to large (upto 2GB)?
Thanks.
Jignesh
Hi.
I am upgrading a product that formerly required the Symantec protocol to talk to Protection Engine, but in the new release it only supports ICAP. I will be rolling the upgrade through both test and pre-production environments, but I don't want to switch the Protection Engine from Symantec native protocol to ICAP because that would leave my existing systems with no antivirus protection. Is there a way for the Protection Engine to support both protocols at the same time on different ports?
The only thing I came up with was to install a second instance of Protection Engine, in a different folder on the server, and configure the second instance for ICAP. The obvious downside is the need to keep both installations updated with definitions.
Thanks
Joe
We have Protection Engine all set up for trial purposes, and everything works fine...
...until we try to scan a password-protected PDF file, which causes the following internal crash:
[OverflowException: Value was either too large or too small for a character.] System.Convert.ToChar(Int32 value) +6790142 com.symantec.scanengine.api.Connection.Read(Stream resultStream, Policy requestPoicy) +622 [ScanException: Error while reading responseERR_RECIEVEING_RESPONSE] com.symantec.scanengine.api.Connection.Read(Stream resultStream, Policy requestPoicy) +1397 com.symantec.scanengine.api.StreamScanRequestImpl.Finish(Stream resultFile) +387 [ScanException: ERR_RECIEVEING_RESPONSE] com.symantec.scanengine.api.StreamScanRequestImpl.Finish(Stream resultFile) +1016
The same file scans perfectly if I use the command-line tool on the server, so this must have something to do with the SDK implementation...? I haven't seen any other posts that address this specific issue.
In addition to the error code being misspelled, the message is not particularly helpful to me as an application developer. Since this is a System exception, my assumption is that this is some kind of bug in the SDK. Any ideas whether there's anything I can do on my end to work around this issue?
Hi all,
everything is in the subject. I'm trying to update Virus Signature of my SPE but I don't any access to Internet from this server. So I would like to know how I could download a virus signature file from Symantec website and how I could install this file manually.
Someone could help me please ?
Thank you in advance.
Wagab
Can anyone provide and details about the expected End-Of-Life date for the Symantec Protection Engine product?
Thanks!
CrashOverride
Î using the command line scanner ssecls to scan a file on local disk.file size around 4 Gb zipped.
the command line scanner retuns the following output :
Virus scan process began : Tue Jan 13 14:04:04 2015
Virus scan process completed : Tue Jan 13 14:06:02 2015
Defs Version =
Command Scanner = 7.0.0.10
Total bytes = 0 (Bytes 0.000)
Elapsed = 118.4040
Scan Rate = 0.00 (Bytes/sec)
Files Excluded = 0
Files Scanned = 0
Directories Scanned = 0
Directories Excluded = 0
Files Skipped = 0
Files Scan Error = 1
Filesinfected = 0
Error List :
Error Processing File c:\temp\test.zip
the zipfiles is build up with 42432 files in total.
protection engine is configured in icap mode.
For POC purpose I made configuration of SPE 7.5 with squid connecting via ICAP. At the beginning I would like to only scan files but do not interfere user connection. Is it possible to run SPE in mode to allow only log incidents? Scan only policy block file and redirect user to inforation site.
Thank You in advance
Best Regards
Grzegorz
Hi,
I am currently testing the trial version of symantec protection engine. I am not sure about the response i am sending to the server.
For a clean file the response is
ICAP/1.0 204 No Content Necessary
ISTag: "B41A93E53F1B67B8551C585752E74D89"
Date: Mon Mar 02 18:34:47 2015 GMT
Service: Symantec Protection Engine/7.5.1.5
Service-ID: Respmod AV Scan
ICAP/1.0 204 No Content Necessary
ISTag: "B41A93E53F1B67B8551C585752E74D89"
Date: Mon Mar 02 18:34:47 2015 GMT
Service: Symantec Protection Engine/7.5.1.5
Service-ID: Respmod AV Scan
X-Outer-Container-Is-Mime: 0
For a infected file with dummy virus the response is like
ICAP/1.0 200 OK
ISTag: "B41A93E53F1B67B8551C585752E74D89"
Date: Mon Mar 02 17:23:31 2015 GMT
Service: Symantec Protection Engine/7.5.1.5
Service-ID: Respmod AV Scan
X-Infection-Found: Type=0; Resolution=0; Threat=EICAR Test String;
X-Violations-Found: 1
test.txt
EICAR Test String
11101
0
X-Outer-Container-Is-Mime: 0
ICAP/1.0 200 OK
ISTag: "B41A93E53F1B67B8551C585752E74D89"
Date: Mon Mar 02 17:23:31 2015 GMT
Service: Symantec Protection Engine/7.5.1.5
Service-ID: Respmod AV Scan
X-Infection-Found: Type=0; Resolution=0; Threat=EICAR Test String;
X-Violations-Found: 1
test.txt
EICAR Test String
11101
0
please let me know what is the meaning of status 200 and 204 and how to know if the file is clean?
Thanks
Shriram
Hi,
We refer to your product Symantec Protection Engine for Cloud Services version 7.5 for Microsoft Windows Server 2008.
We need to ingrate our Java based web application with the Symantec Protection Engine.
We noted that Symantec's Java SDK requires Java Runtime Environment (JRE) 1.6 Update 25 or later.
Our web application uses Java SE Runtime Environment Java SE 6 Update 14 (build 1.6.0_14-b08).
Please help to provide the system requirements for the earlier version of
1. Symantec Protection Engine for Microsoft Windows Server 2008, and
2. Corrsponding Java SDK.
Are the earlier versions available online for trial?
We will also try the trialware in the mean time.
Thanks.
