Symantec Scan Engine/Symantec Protection Engine Fails to release files that have caused an Internal Server Error

Products

• Protection Engine for Cloud Services
• Scan Engine
• Protection Engine for NAS

Issue/Introduction

Symptoms
 

• End users experience "endless" hourglasses when right-clicking to select a file, and aren't able to access the file, or an attempt to drag-and-drop the file from the filer will result in a Windows generic error "Cannot copy : Access is denied. Make sure the disk is not full or write-protected and that the file is not currently in use."
• End users experience denial of access from their sharepoint server referencing an internal error.
• Windows Application Log may show Event ID: 103 (Decomposer 24 warning)
• A NetApp Filer's logs may show a 0x5 error with a timestamp that matches the Windows Application Log.
• If configured for SMTP notification, Scan Engine/Symantec Protection Engine ("Scan Engine") sends an email notification with a title of "Scan Engine Error" to the administrator. This notification notes a Result Code of 24 from a Scanner of "Generic"

 

Cause

Symantec Scan Engine experienced an unexpected exception while attempting to scan a file. By default, Scan Engine responds by reporting an Internal Server Error to the NetApp vscan connector which prohibits access to the file. Even when Scan Engine has been configured to "Allow access and generate a log entry" in the container handling properties when a processor limit is met (or exceeded).  The "Allow access and generate a log entry" is specific for container violations, and does not apply to scan errors. 

 

Resolution

1. In the web interface, return the in-memory file system settings to the defaults.
2. Test by rescanning the file or files which previously caused symptoms.
3. If symptoms persist, work around this behavior by setting "AllowAccessOnScanError" value to "true". See the following article for details: Allow Access on Scan Error for Symantec Scan Engine.
4. (Optional) Alter the file and rescan using a divide and conquer methodology to determine what portion of the container file is malformed.

Please also see the following article for more information on troubleshooting Decomposer and Generic 24 errors: Symantec Scan Engine/Symantec Protection Engine is reporting Decomposer Error 24 and/or Generic Error 24.

To return the in-memory file system settings to the defaults

1. In the web interface for Scan Engine 5.x, click Configuration> Resources.
2. If the field "Maximum RAM used for in-memory file system:" is more than 16, change it to 16.
3. If the field "Maximum file size stored within the in-memory file system:" is more than 3, change it to 3.
4. Click the Save symbol.
5. Click the Apply symbol.