Large files filling up disk drive on SPE in symcscan temp folder
Article ID: 428656
Updated On:
Products
Issue/Introduction
One or more large files are filling up hard drive space on the Symantec Protection Engine (SPE). The files are found in the following location:
/opt/SYMCscan/temp/.symcscantmp.<identifier>/csapiea<identifier>/<name>
The files continue to grow in size and are not deleted unless SPE services are restarted.
Environment
Symantec Protection Engine 9.x
Cause
Environmental factors preventing the system from cleaning up these temporary files.
Resolution
Generally this issue is caused by environmental factors that prevent SPE from fully deleting the temporary files. Those factors include:
- Another application on the server holding the file (Security software, backup solution, etc)
- Network connection being held open
To see if another File Descriptor is holding on to the files, the lsof command below can be ran:
lsof -p <process pid>
CSAPI logging may need to be gathered for more details about why SPE is unable to delete the files.
Additional Information
The folder mentioned above is a temporary working directory for SPE. When SPE's configured memory cache size is exceeded, it will begin using the temp directory. It's used to extract, decompress, scan embedded objects, etc. This folder can see heavy use when very large, multiple archives deep, or other complex files are scanned or if cleanup fails.
Feedback
