> Source: [sk182628](https://support.checkpoint.com/results/sk/sk182628) # sk182628 - "Error while processing '{#number}.file': Parser internal Error (1)" during Content Awareness inspection of large files and files in specific formats | Property | Value | |----------|-------| | Solution ID | sk182628 | | Date Created | 2024-09-03 | | Last Modified | 2026-05-08 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Symptoms - * When you process files, especially large files or files in specific formats (examples: .pdf, ZIP), this parser internal error occurs during the Content Awareness inspection: `Error while processing '{#number}.file': Parser internal Error (1)` * The magic file number of the applicable file is the same as ZIP's file magic number. You can verify this with the command: `# xxd -l 4 ` Expected output is: 00000000: 50 4b 03 04 00000000: 50 4b 05 06 00000000: 50 4b 07 08 These are magic file numbers for ZIP. ## Cause The system incorrectly sends files to the `cp_file_convert` process when only file attributes are configured in the Rule Base. This occurs because the system checks for content even when the match should only be based on file attributes, causing the conversion process to fail.
## Solution [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing it. For faster resolution and verification, collect these files: 1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case. 2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member involved in the case. **Hotfix installation instructions:** Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597). The Hotfix addresses an issue where Content Awareness File Attribute Data Types, such as file name, file extension, or file type matching, could unnecessarily trigger deeper content/archive processing and send files for conversion even when archive content extraction was not required by the Rule Base. After installing the Hotfix, File Attribute-based rules do not require unnecessary deep content processing for this scenario. In addition, the Hotfix adds the *dlpda_disable_archive_extraction* kernel parameter. This parameter provides a global control for whether Content Awareness extracts files from archives before matching the configured Content Awareness Data Types in the Rule Base. It can be used in environments where archive content extraction is not required and the administrator wants to avoid extracting archive contents globally by the Content Awareness blade. * **dlpda_disable_archive_extraction=0** - Archive extraction is enabled. Content Awareness extracts archive content and can match files inside the archive, for example an executable file inside a ZIP file. This is required when the Rule Base is expected to block or allow files based on Content Awareness inspection of the files contained inside archives. * **dlpda_disable_archive_extraction=1** - Archive extraction is disabled. Content Awareness does not extract files from archives. The archive itself can still be inspected as a file, but files inside the archive are not opened as separate files for Content Awareness inspection. As a result, rules that rely on Content Awareness detecting files inside archives, for example blocking an *Executable File* inside a ZIP file, may not match. **Rule Base impact:** * If the Rule Base checks only the archive file itself, for example ZIP file name, ZIP extension, or ZIP file type, disabling archive extraction can prevent unnecessary extraction and conversion. * If the Rule Base uses Content Awareness Data Types that rely on inspecting files contained inside archives, for example executable files, documents, scripts, or other file types inside ZIP files, archive extraction must remain enabled. Otherwise, the inner files are not inspected by Content Awareness, and the matching rule may not be enforced. * This parameter is global. It cannot be enabled or disabled per rule. Archive extraction is either enabled for all relevant Content Awareness rules or disabled globally. You can control the behavior with the commands: * Disable archive extraction (survives reboot): `# fw ctl set -f int dlpda_disable_archive_extraction 1` * Enable archive extraction (survives reboot): `# fw ctl set -f int dlpda_disable_archive_extraction 0` * Verify the current value: `# fw ctl get -f int dlpda_disable_archive_extraction` **Important:** The Hotfix resolves the File Attribute processing behavior described above. The *dlpda_disable_archive_extraction* parameter is an additional global control. Enabling archive extraction may increase CPU usage and processing time, especially for large, compressed, corrupted, password-protected, or unsupported archive files. Disabling archive extraction may improve performance in environments where only the archive file attributes are required. However, it can prevent Content Awareness from matching rules that rely on inspection of files located inside archives, for example detecting an *Executable File* inside a ZIP file. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content