SPE Slow RPC scan

Products

• Protection Engine for NAS

Issue/Introduction

 When attempting to copy a file to a share hosted on a NetApp Filer, the copy operation appears to hang for over a minute.

An email is received similar to the following: 

A container violation has been found Date/time of event = 2020-10-12 15:44:19 Event Severity Level = Warning File name = \\?\UNC\hostname.subdomain.domain.tld\ontap_admin$\NS\Home\username\Desktop\Symantec_Endpoint_Protection_14.3.0_MP1_SEPM_EN.exe File status = NOT REPAIRED Component name = Symantec_Endpoint_Protection_14.3.0_MP1_SEPM_EN.exe Component disposition = NOT REPAIRED Container Violation = Container extract time limit exceeded Scan Duration (sec) = 73.413 Connect Duration (sec) = 73.428 Symantec Protection Engine IP address = 10.8.14.86 Uptime (in seconds) = 2644453 Symantec Protection Engine IP address = 10.8.14.86 Uptime (in seconds) = 2644453 Date/time of event(with millisec) = 2020-10-12 15:44:19:839

Environment

Release : 7.9

Component :

Resolution

1. Confirm Best Practices are being followed for NetApp Filer with Symantec Protection Engine.
   
   Title: 152420 - Best Practices for implementing Symantec Protection Engine for Network Attached Storage with a NetApp Filer
   URL: https://knowledge.broadcom.com/external/article?articleId=152420
   
   
   
2. Follow the steps in the following document to disable Java certificate revocation checking
   
   Title: 201576 - Local Protection Engine hangs while loading or is extremely slow to load
   URL:  https://knowledge.broadcom.com/external/article?articleId=201576
   
   
   
3. If symptoms persist, raise SPE logs to VERBOSE, enable Resource Consumption Logging (RCL). and reproduce.
   
   Title: 159007 - Enabling verbose logging in Protection Engine
   URL: https://knowledge.broadcom.com/external/article?articleId=159007
   
   Title: SPE 8.1 Help - Enabling resource consumption logging in the Core server only mode
   URL: https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/symantec-protection-engine/8-1/Core_server_only_mode_10/enabling-resource-consumption-logging-in-the-core-v128492872-d4995e22111.html
   
   
   
4. After the reproduction is done, revert the logging level.
5. Zip up the *.xml in the Protection Engine installation folder and the logs folder under the installation folder of Protection Engine.
6. Create a support case with the title "SPE x.y.z RPC slow scan", where x.y.z is the actual Protection Engine version which has slow scan symptoms.
7. Attach the evidence to the case.