It sounds like the FPR may be incomplete which leaves you with mismatching tags. Which application is generating the FPR?

Hi,

I have triggered the scan from command line using sourceanalyzer.

I was able to extract the fpr file and verify the file count.

And when I triggered fpr upload using fortifyclient, the error is shown but in SSC it was getting uploaded.

Am using the same command line options for other directories and they are uploaded successfully. Nothing different for this directory except for the size .. and previous uploads of this fpr were successful. 

Is there a way to verify if fpr was not generated properly?

there was no error seen during the scan.

Also the fpr file size seems large, 365MB

One more thing I observed is of all my scans, only 2 files are facing this upload issue and these file sizes are greater than 200M

I read that the default memory allocated for fortifyclient is 200M.

Is there a way I can allocate more memory to fortifyclient?

Also, I read somewhere in documentation that the file upload size should be less that 2G

https://www.microfocus.com/documentation/fortify-software-security-center/2010/SSC_Help_20.1.0/Content/SSC_UG/Upload_Arts.htm

And I just found this - When I extracted the fpr , the size of audit.fvdl file seems to be 4.2G

but the fpr size is showing 365M (I understand fpr is a compressed file)

As mentioned in my other comments, am using sca command line options to scan. Is there a way to see why fpr is not generated properly?

there's a few ways to trouble shoot here - but first you say you are using 18.2 SSC. This is quite old.
What version client are you using?

Troubleshoot

1 - fire up a test server and add in diags

2 - take the FPR

3 - upload - look in the various logs for clues

or

take the fpr

rename it .zip in new directory

unzip it

did it work? Well then maybe it's an FPR. If it dont work then it isnt

We had users trying to upload all manner of non-FPR to our SSC. Not sure I ever saw your error though.

I tried renaming to .zip and unzipped the file. It was extracted normally. The size of audit.fvdl file is showing 5.7G now

you may have a bingo there.

There are size limits on FPRs, And version limits (new FPR versions shouldnt be loaded to older SSC - without some approval from Open Text).

I cannot find the tomcat file right now - but maybe Tech support will know?
We couldnt load more than 1GB.

I asked the question "why would you want to?"

So turns out the FPR stores not long the snippest but all the source -and if dev's have a lot of binaries etc in their repo then the FPR can get massive - not least if they are hitting some lambda explosion where every line of code gets lit.

shooking_sap said:

I cannot find the tomcat file right now - but maybe Tech support will know?
We couldnt load more than 1GB.

The upload limits can be changed in the app.properties file located in <fortify.home>/conf:

# Upload limit on audit attachments in MB
upload.mb.limit.audit.attachment=3

# Upload limit on analysis results in MB
upload.mb.limit.analysis.result=1024

# Upload limit on plugin size in MB
upload.mb.limit.plugin.bundle=20

# Upload limit on meta value attachment in MB
upload.mb.limit.meta.value.attachment=50

Where is <fortify.home>? About the fortify.home Directory (microfocus.com)

You may want to look at reducing the size of the FPR by removing source code - Failed to upload large Artifacts to Fortify SSC (microfocus.com). There are a couple of other KB articles that may be of interest:

• KM03274231: How to generate .fvdl file without code snippets
• KM03274687: .fvdl file contains code snippet 

Hi, 

I have tried changing those parameters but no luck.

The size of fpr is showing 382M .. I saw the size of fvdl files only after unzipping the fpr.

I also found this line in the scan console output - 

Found invalid character when writing FVDL @ EngineData/Errors/Error = "Unable to resolve field 'INVALID_SNAPSHOT\u0000_ID' at 

can I remove snippets from fvdl?

But I want source code to be bundled.. as In audit section in Fortify SSC, people should be able to see the source code of the violation..

I found that there are two option - 

-disable-source-bundling -fvdl-no-snippets , 
Can I enable source binding and disable code snippets in fvdl ?

The next step would be to open a ticket with Fortify Support (https://www.microfocus.com/en-us/support/Fortify%20Static%20Code%20Analyzer) for further assistance.