What does "ERROR : Sandboxing::Worker: Could not create sandbox object" message mean?

Products

• Content Analysis Software - CA

Issue/Introduction

You see the error "ERROR : Sandboxing::Worker: Could not create sandbox object" and would like to know the cause for this message.

Cause

The message indicates that the MAA is either not in working condition or that its queue got long enough that Content Analysis stopped sending files to it. This error message could be more clear, but the problem is that the MAA doesn't have enough resources to process more files while Content Analysis is trying to submit them.

The customer could also check the 'System status' whether its green, yellow or red and check whether the Task Queue, Processor and Storage Space are in good 'health' during the error.

The Content Analysis log can provide more information on the error when Sandboxing logging is set to debugging. You can see the following log when the error is occurring.  Note the message prior to the error.

2015-04-16T12:04:12.083288+02:00 cas_1_2-6-x86_64 avservice[4120]: ERROR    : SandboxingBCMAA::Authenticate: Code: [28] Timed out: [https://x.x.x.x/rapi/auth/session]
2015-04-16T12:04:12.083547+02:00 cas_1_2-6-x86_64 avservice[4120]: ERROR    : SandboxingFile::SubmitJob: Error uploading file TP02660302.cab to Blue Coat Malware Analysis Appliance at x.x.x.x
2015-04-16T12:04:15.714415+02:00 cas_1_2-6-x86_64 avservice[4120]: ERROR    : SandboxingBCMAA::SendGetRequest: failed on https://x.x.x.x/rapi/system/health_stats/queues: 28
2015-04-16T12:04:15.714459+02:00 cas_1_2-6-x86_64 avservice[4120]: ERROR    : SandboxingBCMAA::SendGetRequest: failed with HTTP code 0 on https://x.x.x.x/rapi/system/health_stats/queues
2015-04-16T12:04:16.261970+02:00 cas_1_2-6-x86_64 avservice[4120]: ERROR    : SandboxingBCMAA::Authenticate: Code: [28] Timed out: [https://x.x.x.x/rapi/auth/session]
2015-04-16T12:04:16.262261+02:00 cas_1_2-6-x86_64 avservice[4120]: ERROR    : SandboxingFile::SubmitJob: Error uploading file 42.0.2311.90_41.0.2272.118_chrome_updater.exe?cms_redirect=yes&expire=1429192471&ip=213.164.164.164&ipbits=0&mm=28&ms=nvh&mt=1429178053&mv=m&nh=IgpwcjAxLm1hZDA2KgkxMjcuMC4wLjE&pl=19&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,nh,pl,shardbypass&signature=152EE869361946A62DF3DF1FB7FFDB0C6020D20F.4FC44E1FE6F2285186185F1442A41DF2732A85DA&key=cms1 to Blue Coat Malware Analysis Appliance at x.x.x.x
2015-04-16T12:04:16.262297+02:00 cas_1_2-6-x86_64 avservice[4120]: ERROR    : Sandboxing::Worker: Could not create sandbox object
2015-04-16T12:04:16.262427+02:00 cas_1_2-6-x86_64 avservice[4120]: ERROR    : Sandboxing::Worker: Could not create sandbox object
2015-04-16T12:04:23.812202+02:00 cas_1_2-6-x86_64 avservice[4120]: ERROR    : Sandboxing::Worker: Could not create sandbox object
2015-04-16T12:04:23.812247+02:00 cas_1_2-6-x86_64 avservice[4120]: ERROR    : Sandboxing::Worker: Could not create sandbox object
2015-04-16T12:04:23.812289+02:00 cas_1_2-6-x86_64 avservice[4120]: ERROR    : Sandboxing::Worker: Could not create sandbox object

Where x.x.x.x is the MAA IP.

 

Resolution

Potential remedies to this issue:

• Limit the files that are being sent to MAA further
• Limit the number of profiles being used on the MAA
• Change settings on the MAA to run for less time per file
• Add more MAA hardware

Workaround

Please refer to resolution.