14003 - Internal antivirus filter error: Timeout occurred while filtering (Skyhigh Web Gateway Block Page displays error when downloading large archives)

Technical Articles ID: KB91121
Last Modified: 2023-06-27 08:35:38 Etc/GMT

Environment

Skyhigh Web Gateway (SWG) 8.x, 7.8.2.0 and later

Problem

When you download an archive containing several files, you see the error below:

SWG 8.0.x and earlier:

14003 - Internal antivirus filter error: Timeout occurred while filtering.

SWG version 8.1 and later:

Error in AntivirusFilter: 'Call to external Anti-Malware engine provided error: Scanning job "<URL>" didn't finish in time (current queue length is 0)
Archive scanning request from opener starts with embedded cycle, root object omitted.

NOTE: Future releases of SWG record this error in the mwg-core.errors.log.

Cause

Archives and similar files contain several nested objects. SWG scans these objects individually using the Gateway Antimalware (GAM) in the Embedded cycle.
To avoid long running scans, GAM has several hardcoded timeouts, set by File or Object Size. When one of these timeouts is reached, you see the above error.

Allow listing parent object (Archives) might cause scans to reach the threshold because of missing information about parent object. This event can happen when you use a version of the Gateway Anti-Malware With Optimization Rule Set from the Ruleset Library. Because of GAM changes, this ruleset has become outdated.

Solution 1

If you use the Gateway Anti-Malware With Optimization Rule Set from the Ruleset Library, download the latest version.

To import, follow the steps in the chapter "Import a rule set" in the SWG Product Guide for your release.

Solution 2

If you use a customized ruleset:

Do not use "Stop Rule Set" or "Stop Cycle" on root objects when the embedded cycle is triggered.

If you're not using these rules:

Take an example URL out of the error message from mwg-core.errors.log.
Enable rule engine tracing.
Reproduce the issue with this URL.
Disable rule engine tracing.
Gather the feedback file.
Open a support case.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

14003 - Internal antivirus filter error: Timeout occurred while filtering (Skyhigh Web Gateway Block Page displays error when downloading large archives)

Environment

Problem

Cause

Solution 1

Solution 2

Affected Products

Languages:

Title

Title

Knowledge Center

14003 - Internal antivirus filter error: Timeout occurred while filtering (Skyhigh Web Gateway Block Page displays error when downloading large archives)

Environment

Problem

Cause

Solution 1

Solution 2

Affected Products

Languages:

Choose your region

Title

Title