> Source: [sk111760](https://support.checkpoint.com/results/sk/sk111760)

# sk111760 - IPS Update download through Security Gateway with enabled Anti-Virus blade fails at 99%

| Property | Value |
|----------|-------|
| Solution ID | sk111760 |
| Date Created | 2016-05-31 |
| Last Modified | 2018-08-09 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * IPS Update download through Security Gateway with enabled Anti-Virus blade fails at 99%.

* The user sees the following prompt in SmartDashboard: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk111760/Untitled1808080411.png)

* SmartView Tracker log from Anti-Virus blade shows:

  ```
  
  Resource = http://dl3.checkpoint.com/paid/...
  Destination = XXX.deploy.static.akamaitechnologies.com (<IP Address>)
  Protocol = TCP
  Port = http (80)
  Action = Prevent
  Sent Bytes = 0
  Received Bytes = 0
  Reason = Failed to process the file
  Client Type = Other: FDT_LIBCURL
  Information = precise_error: unknown error
  ```

  *Example* :  
  [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk111760/Log.jpg)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk111760/Log.jpg "Click the image to see it in full size in a new tab/window")
* "`Enabled Archive scanning`" box is checked in the Threat Prevention profile that is used in the involved Threat Prevention policy (SmartDashboard - go to "Threat Prevention" tab - in the left tree, click on "Profiles" - go to "Anti-Virus Settings" pane).

* Threat Prevention Engine is current set to "`Block all connections (Fail-close)`" (SmartDashboard - go to "Threat Prevention" tab - in the left tree, expand "Advanced" - go to "Engine Settings" pane).

* Setting Threat Prevention Engine to "`Allow all connections (Fail-open)`" and installing policy resolves the issue (IPS Update download completes successfully).

* Debug of DLPU daemon (per [sk103939](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103939)) during the issue shows:  

  `[KAV] kav_clbk_fn: Object Count=10001, Origin object size=..., Current object size=..., Total object size=... (... left), Ratio=...`  
  `
  [KAV] kav_clbk_fn: Maximum number of extracted files reached, canceling scan...`

## Cause

The default value of "`Maximum number of extracted files`" is set to 10000 (refer to *max_archive_extracted_files* parameter in the *$FWDIR/conf/malware_config* file on Security Gateway).

IPS Update package contains more than 150000 files in the archive.

Note: Increasing the number of "`Maximum number of extracted files`" to such large number will cause high CPU utilization.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content