Decomposer 27 Errors reported to Protection Engine logs.
Article ID: 176266
Updated On:
Products
Issue/Introduction
Symantec Protection Engine (SPE) is configured to scan files from a Netapp Filer. Decomposer 27 errors are randomly reported to the Symantec Protection Engine logs.
Cause
The Decomposer 27 error is most commonly returned on files that are actively modified such as actively written to log files.
When file scan requests are sent to Symantec Protection Engine (SPE) for processing a file integrity check is performed to ensure the file being scanned is the correct file. This integrity check determines if the file size initially reported and the file size received match. If the file sizes do not match SPE will abort the scan with error Decomposer 27.
[1569916161,PID:5008,TID:5320, DEBUG, DEC] CDECFileHandler::GetFileSize(): 16026428 [csapi_cdecfilehandler.cpp:1453(CDECFileHandler::GetFileSize)]
[1569916161,PID:5008,TID:5320, DEBUG, DEC] CDECSink::OnObjectBegin(), Size in TopFileHandler:16026428 Size from Dec : 16026720 [csapi_cdecsink.cpp:1675(CDECSink::OnObjectBegin)]
[1569916161,PID:5008,TID:5320, DEBUG, DEC] CDECFileHandler::GetFileSize(): 16026428 [csapi_cdecfilehandler.cpp:1453(CDECFileHandler::GetFileSize)]
[1569916161,PID:5008,TID:5320, ERROR, DEC] CDECSink::OnObjectBegin(), Corrupt Dec File. Size Mismatch. Stop Decomposition. File Name: mem:// csapi15699161605401.tmp [csapi_cdecsink.cpp:1679(CDECSink::OnObjectBegin)]
Resolution
This is an expected handling of a file size mismatch by the Symantec Protection Engine (SPE) application. SPE is unable to ensure the integrity of the file requested for scanning and cannot complete the request.
To resolve the issue the connector requesting a file scan should ensure the file is not modified between the time the scan request was made and the file was successfully transferred.
Additional Information
The following suggestions may be helpful in reducing the holistic number of Decomposer / 27 and Generic / 6 errors reported in the logs of SPE:
- Within the local UI console of SPE, check the location of the Temp scanning folder as shown on Configuration > Resources
- Confirm that the Symantec Endpoint Protection (SEP) or other realtime filesystem antivirus solution excludes the SPE temp scanning folding from scanning.
- Review the file to confirm that the file is a log that is receiving a large number of write accesses in realtime. If so, consider whether excluding that filetype by extension within the NetApp Filer. For more details, see:
Title: 177975 - Best practices for file type exclusions on Protection for Network Attached Storage.
URL: https://knowledge.broadcom.com/external/article/177975/best-practices-for-file-type-exclusions.html - For more information on files of a given extension, you can raise the logging level of SPE to VERBOSE in the UI on Monitors > Logging, wait several days, then look through the logs for the each scan of a file which has the same extension.
Feedback
