Uncompressed size limit in fortigate 100a

[#1]

hi recently i started seeing File reached uncompressed size limit, where to uncheck this " subtype=scanerror pri=notice fwver=040001 vd=" root" msg=" File reached uncompressed size limit." status=" passthrough" service=" pop3"

[rwpatterson]

Try in the protection profile under AV.

[abelio]

recently i started seeing File reached uncompressed size limit, where to uncheck this

use CLI to adjust how your AV should manage the uncompression of scanned files for pop3 service

 config antivirus service pop3
   set uncompnestlimit  <value>
 end
 

where <value> = max nested compression levels to scan (2-100) default = 12.

[RickP]

recently i started seeing File reached uncompressed size limit, where to uncheck this " subtype=scanerror pri=notice fwver=040001 vd=" root" msg=" File reached uncompressed size limit." status=" passthrough" service=" pop3"

There is no unchecking of that limit. It' s the largest uncompressed file size that will be scanned. Anything larger will be passed through...unless you block it with the oversized file threshold, but that' s a separate thing entirely. The default is 10 MB, and the maximum size depends on the FortiGate model.

[abelio]

indeed, correction: the parameter to correct is another different:

 config antivirus service pop3 
    set   uncompsizelimit <value> 
  end
 

where for an 100A unit is: <value> = max uncompressed size to scan (1-24MB or use 0 for unlimited) apologies for the noise,

[#6]

thanks team

config antivirus service pop3 set uncompsizelimit <value> end

now i have setup this . let me wait and watch.

[#7]

team my apologies for long watch time again the issue started back og_id=0262008961 type=virus subtype=scanerror pri=notice fwver=040003 vd=" root" msg=" File reached uncompressed size limit." status=" passthrough" service=" pop3" my config as follows config antivirus service " pop3" set scan-bzip2 disable set uncompnestlimit 100 set uncompsizelimit 0 end

[abelio]

It' s possible that avalaible memory be exhausted when the unit tried to uncompress the file to scan it.

[#9]

how do we trace it ? is there any command which will help us in this regard?

[edsouza_FTNT]

All this means is that one of the attachments reached the uncompressed size limit, and skipped scanning that attachment. In 4.1 this is now logged, before it was not.