Interpreting error code pairs that appear in the Protection Engine logs
Article ID: 177633
Updated On:
Products
Issue/Introduction
This article describes the different error codes that appear within the *.log files of Symantec Protection Engine (SPE) 7.9.x, 8.x, 9.x
Resolution
The list below is for use as debugging codes for the Symantec Protection Engine product.
This information is provided as is. No further interpretation of these codes is offered or available within the scope of this document.
With the raw logs of Symantec Protection Engine, scan errors appear in two parts, the Module and the result code. Here are Module / result code combinations that have appeared in support cases to date, along with the string version of the error:
|
Module |
Result |
String |
Additional Information |
|
Antivirus |
11 |
|
|
|
Generic |
6 |
RESULT_FILE_NOT_FOUND |
|
|
Generic |
24 |
RESULT_UNEXPECTED_EXCEPTION_CAUGHT |
|
|
Generic |
34 |
Quarantine configuration is invalid. |
|
|
Generic |
36 |
RESULT_SCAN_TIMEOUT |
|
|
Decomposer |
10 |
RESULT_MALFORMED_CONTAINER_DELETED |
|
|
Decomposer |
17 |
RESULT_OPEN_CONTAINER_FAILED |
|
|
Decomposer |
21 |
RESULT_FILE_EXTRACT_FAILED | |
|
Decomposer |
24 |
RESULT_TEMPFILE_ACCESS_FAILED |
|
|
Decomposer |
26 |
The scanner was unable to allocate new memory (out of memory error) |
|
|
Decomposer |
27 |
RESULT_SCAN_ENGINE_EXCEPTION |
|
|
Decomposer |
28 |
A GENERIC error occurred while the decomposer was scanning the file |
|
|
Decomposer |
36 |
RESULT_FILE_SIZE_TOO_LARGE |
|
|
Decomposer |
37 |
The item exceed 2GB in size either as a file or when extracted. |
|
|
Decomposer |
40 |
RESULT_ALGORITHM_UNSUPPORTED |
|
|
Decomposer |
41 |
unknown algorithm found. |
|
|
Decomposer |
42 |
CREATE_OUTPUT_FILE_FAILED |
|
|
Decomposer |
49 |
RESULT_MAX_COMPRESSION_RATIO_LIMIT_REACHED |
204325 |
|
Decomposer |
52 |
RESULT_DATA_SOURCE_ERROR |
Files may have been altered by some other antivirus or similar entity while it is being sent to SPE for scanning and due to that the Data source error is thrown. |
|
Insight |
17 |
RESULT_INSIGHT_INTERNAL_ERROR |
175787 |
|
STARGATE |
10 |
RESULT_DISARM_PROCESS_FILE_FAILED |
232354 - SPE 8.2.x Active content scan causes STARGATE 10 errors |
|
URL List Lookup |
1 |
233942 | |
|
URL List Lookup |
8 |
RESULT_CATEGORY_DOES_NOT_EXIST |
177771 |
Error messages that may accompany the above code pairs in SPE 8.2 and newer
The following error messages can appear in the "Error Message" field with any of the above scan errors:
- Failed with scan error hex code 0x3: This is the scan timeout return code from the underlying AntiVirus scanner. You will normally see it attached to a Decomposer 28 or Antivirus 11 error message. You should see a Generic 36 error for the same file.
- Failed with scan error hex code 0x80800901: A timeout occurred while contacting Mobile Insight servers to determine file reputation for an .APK file. Ensure firewall has an exception for port 443 for mobinsight.symantec.com. Configure SPE to use your proxy if applicable. Consider disabling Mobile Insight if reputation scanning is not needed.
- Failed with scan error hex code 0x80800c00: A network error occurred while contacting insight servers to determine file reputation.
- Failed with scan error hex code 0x80800c01: A timeout occurred while contacting insight servers to determine file reputation. It is most common with binaries and executables. Ensure firewall has an exception for port 443 for ent-shasta-rrs.symantec.com. Consider disabling Insight if reputation scanning is not needed.
- Failed with scan error hex code 0x80800204: This is a generic error given by the internal AV engine. Causes for this error can vary. Does SPE have the latest virus definitions? If these errors appear constantly, contact support to investigate the cause.
For issues discussed above see the SPE Required Ports document. which identifies all ports and host names that must be accessible in order for all SPE features to work.
The following errors do not cite a module.
| Message | Interpretation | Additional Information |
|
Resource Unavailable |
SPE is not able to write to either a memory or disk location | |
| Container violation | The container file, when extracted, is larger than MaxExtractSize. | 242287 |
Please contact support for any of the following:
- If you encounter a Module / result code combination that is not listed here
- If an important file consistently generates an error code, you should submit the file via Symsubmit
- For BROADCOM support to assist with identifying why a given file consistently generates an error, attach the following evidence to a support case:
- Create a new support case in the BROADCOM support portal
- In the Description field, cite an example of the full error from the log which shows the specific file
- In the Description field, include the submission id for the sample file when submitted through SymSubmit
- Use CSAPI logging to trace through the error behavior. For Windows steps, see 157519. For Linux steps, see 164895.
- Scan the example file again
- Revert CSAPI logging changes
- Attach csapi.log (or whatever file SPE created for CSAPI logging) to the case
- Attach a .zip or .tar.gz or .tar.bz2 archive containing contents of <Protection Engine install folder> and <Protection Engine install folder>\logs
- Attach a screenshot showing error that appears in NetApp Filer logs (for RPC protocol) or output from ssecls when scanning the file on demand
.
Additional Information
To re-scan the same file to determine if a scan error for a particular file is local to the machine where Scan Engine is installed
SPE 8.2.2 Help:
- C-based command-line scanner syntax and usage
- Supported command-line options for C-based command-line scanner
Error in a different logfile?
Feedback
