Files accumulate in the Temp folder when scanning files with a path longer than 255 characters via RPC protocol with Scan Engine 5.2.3 or older

Products

• Scan Engine

Issue/Introduction

After scanning files on a NAS device with Scan Engine configured for RPC protocol, you notice that files with a .TMP extension accumulate in the Temp folder for Scan Engine.

Symptoms
 

Log entries similar to the following appear in the Scan Engine logs, the Application Log of Windows Event Viewer, or a notification receved via email:
1228719055|4|2|3|4|\\10.206.10.114\ONTAP_ADMIN$\vol\<path> \winzip90.exe|5|2|6|122871905520675.tmp/SETUP.WZ|7|3|12|4|37|S-1-5-21-2497950810-3593656576-593574081-376867|38|10.206.27.12|39|10.206.27.12|17|0.125|18|0.437|43|10.206.10.118|44|0|45|266185

The Application Log of the Windows Event Viewer may also show:

• Eventid: 1000
  Source: Application Error
  Type: Error
  Description:
  Faulting application symcscan.exe, version 5.2.0.20, faulting module symcscan.exe, version 5.2.2.6, fault address 0x0006d38e.

The System Log of the Windows Event Viewer may also show:

• Eventid: 2013
  Source: Srv
  Description: The D: disk is at or near capacity. You may need to delete some files.

 

Cause

When Symantec Scan Engine is in RPC mode, if the path of a file is greater then 255 bytes, and the file causes a Container limit violation, Scan Engine will fail to delete the .tmp file it created in the \Temp\.symcscantmp.xxxx\ folder.

Resolution

This issue is corrected with Scan Engine build 5.2.4.

To correct this behavior
1. Uninstall Scan Engine 5.2.x.
2. Delete the Scan Engine installation folder.
3. Install Scan Engine 5.2.4 locally rather than via a Remote Desktop or Terminal Services session.