> Source: [sk182545](https://support.checkpoint.com/results/sk/sk182545)

# sk182545 - Content Awareness - File downloaded with 0B size instead of getting blocked

| Property | Value |
|----------|-------|
| Solution ID | sk182545 |
| Date Created | 2024-08-05 |
| Last Modified | 2024-08-06 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS) |

## Symptoms

- * The policy action is set to **"Drop - Blocked Message."**
* The file is downloaded but has a size of **0 bytes**.
* No user notification page is presented to the user.

## Cause

This issue arises when the UserCheck process on the Security Gateway fails to maintain a stable connection. Below are sample debug logs from the UserCheck process that illustrate the failure to sustain the connection while attempting to download `wireshark.exe`:  
> ...\[fw4_0\];1:{webapi} uc_can_redirect: URL: https://2.na.dl.wireshark.org/win64/Wireshark-4.2.5-x64.exe;  
> ...\[fw4_0\];1:{webapi} uc_can_redirect: Content-Type: Unknown;  
> ...\[fw4_0\];1:{webapi} uc_can_redirect: user-agent: Firefox;  
> ...\[fw4_0\];1:{webapi} uc_can_redirect: Will the caller be able to redirect? yes;  
> ...\[fw4_0\];1:{webapi} uc_can_redirect: can't hold the connection;  
>
To confirm that UserCheck is the root cause of the issue, follow these steps:  
1. Modify the Content Awareness Policy

* Change the policy action from **"Drop - Blocked Message"** to **"Drop"**. This adjustment will exclude UserCheck from the policy action.  
2. Verify the Outcome

* With UserCheck removed from the policy action, attempt the file download again. The download should be blocked as expected.
* Check the SmartConsole logs for the Content Awareness Blade. The logs should reflect the policy action and confirm whether UserCheck was indeed the source of the issue.  
![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182545/sk182545202408061755181.png)

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content