Error: "Attempt to make a scan request to vscan server \\[SERVERNAME] failed with error [0xc0020052] (RPC_NT_COMM_FAILURE)" when trying to scan files on NetApp Filer

Products

• Scan Engine

Issue/Introduction

While attempting to scan files, Symantec Scan Engine 5.x disconnects from NetApp Filer and gives errors.

 

 

The logfile on the NetApp filer may show:

CIFS: Attempt to make a scan request to vscan server \\[SERVERNAME] failed with error [0xc0020052] (RPC_NT_COMM_FAILURE).
CIFS: Virus scan server \\[SERVERNAME] ([ip-address]) has disconnected from the filer.
CIFS: Vscan server [ip-address] completed a scan request for ONTAP_ADMIN$\[path to the file] but the original request was not found.
CIFS: Warning for server \\[SERVERNAME]: Connection terminated.
CIFSRPC: An RPC exception with a server of type vscan server occurred.

Where,

[SERVERNAME] shows the server's name.
[ip-address] shows the server's ip address.
[path to the file] shows the path to the file.

 

 

Cause

The following chain of events occurs:

1. Symantec Scan Engine takes longer to access and scan a file than the timeout value configured within NetApp Filer (default 10 seconds).
2. When the timeout value passes, NetApp Filer sends a scan status request to Scan Engine.
3. When Scan Engine is queueing scan requests, it also queues scan status requests.
4. Under these conditions, Scan Engine may not respond to the scan status request before NetApp Filer determines that the Scan Engine is offline.

 

 

Resolution

There are multiple possible responses to these NetApp Filer log entries:
 

• Increase the scan timeout value at the NetApp Filer.
• Install additional Scan Engines to prevent individual Scan Engines from queueing scan requests.
• Examine the logs of Scan Engine to determine if a scan request took longer than the timeout configured in the NetApp Filer. If the result of the long scan request was an error or warning, troubleshoot that error or warning result.