Interpreting error code pairs that appear in the Protection Engine logs

Products

Protection Engine for Cloud Services Protection for SharePoint Servers Protection Engine for NAS

Issue/Introduction

This article describes the different error codes that appear within the *.log files of Symantec Protection Engine (SPE) 7.9.x .or 8.x.

Resolution

The list below is for use as debugging codes for the Symantec Protection Engine product.
This information is provided as is. No further interpretation of these codes is offered or available within the scope of this document.

With the raw logs of Symantec Protection Engine, scan errors appear in two parts, the Module and the result code. Here are Module / result code combinations that have appeared in support cases to date, along with the string version of the error:

Module	Result	String	Additional Information
Antivirus	11		0x80800204: Does SPE have the latest virus definitions? 0x80800204: Does SEP Agent have exclusions for the SPE temp scanning folder?
Generic	6	RESULT_FILE_NOT_FOUND	177374 SPE for NAS after upgrade: 264235
Generic	24	RESULT_UNEXPECTED_EXCEPTION_CAUGHT	152398
Generic	34	Quarantine configuration is invalid.	163512
Generic	36	RESULT_SCAN_TIMEOUT	189716
Decomposer	10	RESULT_MALFORMED_CONTAINER_DELETED
Decomposer	17	RESULT_OPEN_CONTAINER_FAILED	as SPE scans a file on a UNC share: 157848 as SPE scans local file via local instance of ssecls: 177801
Decomposer	21	RESULT_FILE_EXTRACT_FAILED	215891
Decomposer	24	RESULT_TEMPFILE_ACCESS_FAILED	152398 0x80800204: Does SEP Agent have exclusions for the temp scanning folder of SPE?
Decomposer	26	The scanner was unable to allocate new memory (out of memory error)	156444
Decomposer	27	RESULT_SCAN_ENGINE_EXCEPTION	176266 SPE7.0.x: 158456
Decomposer	28	A GENERIC error occurred while the decomposer was scanning the file	0x80800204: Does SPE have the latest virus definitions? SPE8.2.x for large tar files with corrupt headers: 232325
Decomposer	36	RESULT_FILE_SIZE_TOO_LARGE
Decomposer	37	The item exceed 2GB in size either as a file or when extracted.	TECH205182 TECH207343
Decomposer	40	RESULT_ALGORITHM_UNSUPPORTED
Decomposer	41	unknown algorithm found.
Decomposer	42	CREATE_OUTPUT_FILE_FAILED
Decomposer	49	RESULT_MAX_COMPRESSION_RATIO_LIMIT_REACHED	204325
Insight	17	RESULT_INSIGHT_INTERNAL_ERROR	175787
STARGATE	10	RESULT_DISARM_PROCESS_FILE_FAILED	232354 - SPE 8.2.x Active content scan causes STARGATE 10 errors
URL List Lookup	1		233942
URL List Lookup	8	RESULT_CATEGORY_DOES_NOT_EXIST	177771

Error messages that may accompany the above code pairs in SPE 8.2 and newer

The following error messages can appear in the "Error Message" field with any of the above scan errors:

Failed with scan error hex code 0x3: This is the scan timeout return code from the underlying AntiVirus scanner. You will normally see it attached to a Decomposer 28 or Antivirus 11 error message. You should see a Generic 36 error for the same file.
Failed with scan error hex code 0x80800901: A timeout occurred while contacting Mobile Insight servers to determine file reputation for an .APK file. Ensure firewall has an exception for port 443 for mobinsight.symantec.com. Configure SPE to use your proxy if applicable. Consider disabling Mobile Insight if reputation scanning is not needed.
Failed with scan error hex code 0x80800c00: A network error occurred while contacting insight servers to determine file reputation.
Failed with scan error hex code 0x80800c01: A timeout occurred while contacting insight servers to determine file reputation. It is most common with binaries and executables. Ensure firewall has an exception for port 443 for ent-shasta-rrs.symantec.com. Consider disabling Insight if reputation scanning is not needed.
Failed with scan error hex code 0x80800204: This is a generic error given by the internal AV engine. Causes for this error can vary. Does SPE have the latest virus definitions? If these errors appear constantly, contact support to investigate the cause.

The following errors do not cite a module.

Message	Interpretation	Additional Information
Resource Unavailable	SPE is not able to write to either a memory or disk location	8.1 on Linux: 203299 7.x-8.0.1: 157902
Container violation	The container file, when extracted, is larger than MaxExtractSize.	242287

Please contact support for any of the following:

If you encounter a Module / result code combination that is not listed here
If an important file consistently generates an error code, you should submit the file via Symsubmit

For BROADCOM support to assist with identifying why a given file consistently generates an error, attach the following evidence to a support case:
- Create a new support case in the BROADCOM support portal
- In the Description field, cite an example of the full error from the log which shows the specific file
- In the Description field, include the submission id for the sample file when submitted through SymSubmit
- Use CSAPI logging to trace through the error behavior. For Windows steps, see 157519. For Linux steps, see 164895.
- Scan the example file again
- Revert CSAPI logging changes
- Attach csapi.log (or whatever file SPE created for CSAPI logging) to the case
- Attach a .zip or .tar.gz or .tar.bz2 archive containing contents of <Protection Engine install folder> and <Protection Engine install folder>\logs
- Attach a screenshot showing error that appears in NetApp Filer logs (for RPC protocol) or output from ssecls when scanning the file on demand

.

Additional Information

To re-scan the same file to determine if a scan error for a particular file is local to the machine where Scan Engine is installed

SPE 8.2.2 Help:

Error in a different logfile?

For errors in cafagent.log, see Additional Information on 172637
For errors in lux.log, see 181764
For errors in SymantecProtectionAbortLog.txt, see Additional Information on 198647