Interpreting error code pairs that appear in the Protection Engine logs
search cancel

Interpreting error code pairs that appear in the Protection Engine logs

book

Article ID: 177633

calendar_today

Updated On:

Products

Protection Engine for Cloud Services Protection for SharePoint Servers Protection Engine for NAS

Issue/Introduction

 

This article describes the different error codes that appear within the *.log files of Symantec Protection Engine (SPE) 7.9.x .or 8.x.

Resolution

The list below is for use as debugging codes for the Symantec Protection Engine product.
This information is provided as is. No further interpretation of these codes is offered or available within the scope of this document.


With the raw logs of Symantec Protection Engine, scan errors appear in two parts, the Module and the result code. Here are Module / result code combinations that have appeared in support cases to date, along with the string version of the error:  

Module

Result

String

Additional Information

Antivirus

11

 

  • 0x80800204: Does SPE have the latest virus definitions?
  • 0x80800204: Does SEP Agent have exclusions for the SPE temp scanning folder?

Generic

6

RESULT_FILE_NOT_FOUND

Generic

24

RESULT_UNEXPECTED_EXCEPTION_CAUGHT

152398

Generic

34

Quarantine configuration is invalid.

163512

Generic

36

RESULT_SCAN_TIMEOUT

189716

Decomposer

10

RESULT_MALFORMED_CONTAINER_DELETED

 

Decomposer

17

RESULT_OPEN_CONTAINER_FAILED

  • as SPE scans a file on a UNC share: 157848
  • as SPE scans local file via local instance of ssecls: 177801

Decomposer

21

RESULT_FILE_EXTRACT_FAILED

215891  

Decomposer

24

RESULT_TEMPFILE_ACCESS_FAILED

  • 152398
  • 0x80800204: Does SEP Agent have exclusions for the temp scanning folder of SPE?

Decomposer

26

The scanner was unable to allocate new memory (out of memory error)

156444

Decomposer

27

RESULT_SCAN_ENGINE_EXCEPTION

Decomposer

28

A GENERIC error occurred while the decomposer was scanning the file

  • 0x80800204: Does SPE have the latest virus definitions?
  • SPE8.2.x for large tar files with corrupt headers: 232325

Decomposer

36

RESULT_FILE_SIZE_TOO_LARGE

 

Decomposer

37

The item exceed 2GB in size either as a file or when extracted.

TECH205182

TECH207343

Decomposer

40

RESULT_ALGORITHM_UNSUPPORTED

 

Decomposer

41

unknown algorithm found.

 

Decomposer

42

CREATE_OUTPUT_FILE_FAILED

 

Decomposer

49

RESULT_MAX_COMPRESSION_RATIO_LIMIT_REACHED

204325

Decomposer

52

RESULT_DATA_SOURCE_ERROR

Files may have been altered by some other antivirus or similar entity while it is being sent to SPE for scanning and due to that the Data source error is thrown.

Insight

17

RESULT_INSIGHT_INTERNAL_ERROR

175787

STARGATE

10

RESULT_DISARM_PROCESS_FILE_FAILED

232354 - SPE 8.2.x Active content scan causes STARGATE 10 errors

URL List Lookup

1

  233942

URL List Lookup

8

RESULT_CATEGORY_DOES_NOT_EXIST

177771

 

Error messages that may accompany the above code pairs in SPE 8.2 and newer

The following error messages can appear in the "Error Message" field with any of the above scan errors:

  • Failed with scan error hex code 0x3: This is the scan timeout return code from the underlying AntiVirus scanner. You will normally see it attached to a Decomposer 28 or Antivirus 11 error message. You should see a Generic 36 error for the same file.
  • Failed with scan error hex code 0x80800901: A timeout occurred while contacting Mobile Insight servers to determine file reputation for an .APK file. Ensure firewall has an exception for port 443 for mobinsight.symantec.com. Configure SPE to use your proxy if applicable. Consider disabling Mobile Insight if reputation scanning is not needed.
  • Failed with scan error hex code 0x80800c00: A network error occurred while contacting insight servers to determine file reputation. 
  • Failed with scan error hex code 0x80800c01: A timeout occurred while contacting insight servers to determine file reputation. It is most common with binaries and executables. Ensure  firewall has an exception for port 443 for ent-shasta-rrs.symantec.com. Consider disabling Insight if reputation scanning is not needed.
  • Failed with scan error hex code 0x80800204: This is a generic error given by the internal AV engine. Causes for this error can vary. Does SPE have the latest virus definitions? If these errors appear constantly, contact support to investigate the cause.

 

The following errors do not cite a module. 

Message Interpretation Additional Information

Resource Unavailable

SPE is not able to write to either a memory or disk location
Container violation The container file, when extracted, is larger than MaxExtractSize. 242287
     

 

Please contact support for any of the following:

  • If you encounter a Module / result code combination that is not listed here
  • If an important file consistently generates an error code, you should submit the file via Symsubmit


  • For BROADCOM support to assist with identifying why a given file consistently generates an error, attach the following evidence to a support case:
    - Create a new support case in the BROADCOM support portal
    - In the Description field, cite an example of the full error from the log which shows the specific file
    - In the Description field, include the submission id for the sample file when submitted through SymSubmit
    - Use CSAPI logging to trace through the error behavior. For Windows steps, see 157519. For Linux steps, see 164895.
    - Scan the example file again
    - Revert CSAPI logging changes
    - Attach csapi.log (or whatever file SPE created for CSAPI logging) to the case
    - Attach a .zip or .tar.gz or .tar.bz2 archive containing contents of <Protection Engine install folder> and <Protection Engine install folder>\logs
    - Attach a screenshot showing error that appears in NetApp Filer logs (for RPC protocol) or output from ssecls when scanning the file on demand

    .

 

 

 

 

Additional Information

To re-scan the same file to determine if a scan error for a particular file is local to the machine where Scan Engine is installed

SPE 8.2.2 Help:

 

Error in a different logfile?

  • For errors in cafagent.log, see Additional Information on 172637
  • For errors in lux.log, see 181764
  • For errors in SymantecProtectionAbortLog.txt, see Additional Information on 198647