DLP Scanning: File Size Limitations

[Chitown_Renegade]

Hello,

Based on the documentation and based on the current configuration of our DLP envrionmnet, we are configued to be able to scan the 1st 30MB of a particular file. Some scaling can be done to increase that limit to 2GB. 

Question: Once a full scan is done of a file that is 1 GB and only the 1st 30 MB are scanned; does doing a incremental scan of the same file scan 30 MB of the remaining 970 MB? If not, what happens. Thank you. 

[dlpadmin1601]

bump. 

[Alan.Waggott]

Hi Chitown,

 

You would need to run a full scan, as the file has already been scanned, unless any changes have been made within the actual file then scan won't re-scan it on an incremental

 

Thanks

[Chitown_Renegade]

@Alan.Waggott,

So if I understand you correctly, once a file has been scanned (30 MB default limit), the only real option is to run a full scan on the same file for Symantec to scan the next 30MB? Or, once a file has been scanned with the default limit, incremental scans will not scan the next 30 MB and there is no way to scan past the 1st 30MB? Appreciate your help in getting a better understand of this. 

[Fady azab]

Hi 

it will only scan the 1st 30 MB of a file , you can increase this value to scan more file sizes 

https://support.symantec.com/us/en/article.TECH252393.html

 

[Alan.Waggott]

Hi Fady,

 

In 15.5 you can now do this directly from the console and increase the file size limitation to 2GB

 

Cheers

[Alan.Waggott]

Hi Chitown,

If you are running DLP 15.5 you can increase the inspection content size in the Detection tab of the dectection server configuration. Once you have done this you will either need to run a full scan or change something in the file for it to be rescanned.

 

I hope that makes sense.

 

Cheers

[Alan.Waggott]

Hi Chitown,

I have been doing some work around this over the last few days, and the sizing guides have come in very handy.

If you're looking at scanning a 2GB file at DAR then you will need a very beefy server

https://support.symantec.com/us/en/article.tech252393.html - Fady has already posted this in the above comment

However is you refer to page 8 in the link below this will tell you the specs you need

https://symwisedownload.symantec.com/resources/sites/SYMWISE/content/live/SOLUTIONS/252000/TECH252393/en_US/DLP%20Guidelines%20for%20Tuning%20Large%20Files.pdf?__gda__=1574403049_13b385c5a3c4272ab44631c01664fb96

To scan 2GB you will need a minimum of 4 CPU's and 130GB

 

Hope this helps

 

Thanks