Endpoint Security for Storage error messages overview
Technical Articles ID:
KB83744
Last Modified: 2023-03-28 13:08:04 Etc/GMT
Last Modified: 2023-03-28 13:08:04 Etc/GMT
Environment
Endpoint Security Storage Protection (ENSSP) 2.x
For details of ENS for Storage supported environments, see KB94811 - Supported platforms for Endpoint Security Storage Protection.
For details of ENS for Storage supported environments, see KB94811 - Supported platforms for Endpoint Security Storage Protection.
Summary
This article describes the error messages you might encounter in the following logs related to ENS for Storage, or the NetApp ONTAP Log:
CAUTION: This article contains information about opening or modifying the registry.
There are several messages covered in this article. Use the following links to go to the relevant section of this article, or external website, as per your needs.
ENSSP Product:Config::SetScanThreadPriority, g_hReloadDAT_Mutex
The following error messages display inStorageProtection_Debug.log
At the ENSSP ICAP scanner startup:
Error Config::SetScanThreadPriority : is 0
Warning ICAPConfig::SetMaxConnections : 130
At the ENSSPNetApp scanner startup:
Error Config::SetScanThreadPriority : is 0
Error $$$$NetAppScannerPlugIn$$$ g_hReloadDAT_Mutex event open 0 2
Error $$$$NetAppScannerPlugIn$$$ g_hReloadDAT_Mutex event creation 370 0
Error $$$$NetAppScannerPlugIn$$$ g_hReloadENG_Mutex event open 0 2
Error $$$$NetAppScannerPlugIn$$$ g_hReloadENG_Mutex event creation 374 0
At the ENSSP scanner shutdown:
Error $$$$NetAppScannerPlugIn$$$ g_hReloadDAT_Mutex event open 0 2
Error $$$$NetAppScannerPlugIn$$$ g_hReloadDAT_Mutex event creation 374 0
Error $$$$NetAppScannerPlugIn$$$ g_hReloadENG_Mutex event open 0 2
Error $$$$NetAppScannerPlugIn$$$ g_hReloadENG_Mutex event creation 370 0
This output isn't an error; these messages are normal ENSSP scanner startup and shutdown messages.
Back to top
ENSSP Product: RPC Scan 'Result Status' Codes
The following error messages display inStorageProtection_Debug.log :
Request NetAppScanInfo::NotifyFilerOfScanResult : Notified Filer [x.x.x.x] successfully of scan results for file [\\path\filename.ext]. Result String [File is clean.] Result Status [0]
Or
Request NetAppScanInfo::NotifyFilerOfScanResult : Notified Filer [x.x.x.x] successfully of scan results for file [\\path\filename.ext]. Result String [The file was threatened and was successfully deleted.] Result Status [5]
Or
Request NetAppScanInfo::NotifyFilerOfScanResult : Notified Filer [x.x.x.x] successfully of scan results for file [\\path\filename.ext]. Result String [The scan exceeded the maximum scan time allowed] Result Status [17]
[0] - scanned file is clean, excluded, or repaired
[5] - scanned file is deleted
[6] - file deletion could not be accomplished
[10] - insufficient permission to access the file
[11] - file is not found
[12] - file could not be scanned because of a sharing violation
[17] - scan timed out
[18] - file could not be scanned because of an unspecified error
Back to top
ENSSP Product: ScanThread did not start as expected
The following error messages display inStorageProtection_Debug.log :
Error $$$ScanThread::Create not signalled the m_hSignalReady
Error ERROR: ScanThread did not start as expected.
Warning ScanThreadManager::GetAvailableScanThread : Invalid scanner [NetAppScanner].
The ENSSP scanner is unable to obtain a ENS scan thread for the ENSSP scan request.
Back to top
ENSSP Product: Server is at max connections
The following error message displays inStorageProtection_Debug.log :
Warning SocketManager::IsConnectionAllowed Warning connection not allowed server is at max connections, 130 - x.x.x.x
The configured ENSSP scan thread count is insufficient to handle the number of incoming scan requests.
Back to top
ENSSP Product: EngineServerDied, Unable to init scanner, Invalid scanner
The following error messages display in StorageProtection_Debug.log :
Error EngineServerDied callback received
Error EngineWrapper GetScanner: Error, unable to init scanner.
Error ScannerWrapper Constructor: invalid scanner
Warning ScanThreadManager::GetAvailableScanThread : Invalid scanner [NetAppScanner] .
Warning ScanProvider::ScanRequest unable to handle scan request all scanners currently in use. - file \\?\UNC\x.x.x.x\path\filename.ext
Warning NetAppScannerPlugIn::VS_ScanRequest File="path\filename.ext" Too busy to handle request.
The 'Trellix McShield' service (ENS 10.x + ENSSP 2.x) is either offline, unresponsive, or unreachable.
Back to top
ENSSP Product: The file was not scanned. This is usually caused by an extension check
The following error messages display inStorageProtection_Debug.log :
The file was not scanned. This is usually caused by an extension check.
This error message makes only one statement with certainty; the file isn't scanned. The most likely reason is that this message is as-designed because the ENSSP policy 'NetApp Policies' has been defined with one or more exclusions.
The file that's sent for scanning matches an exclusion, so ENSSP doesn't scan the file, logs this message, and sends a 'clean' result for that file to the appliance. If no exclusion that matches the file is present, this error message means that the file isn't scanned. No cause can be attributed without the ENSSPStorageProtection_Debug.log and a Wireshark trace being generated during the time of one of these messages.
Back to top
Win32: 0x5
The following error messages display inStorageProtection_Debug.log or EndpointSecurityPlatform_Errors.log :
Error FilerServer::ContactFiler() exception 0x5 (5) reported while trying to register with filer [x.x.x.x]
ERROR_ACCESS_DENIED
Access is denied.
MicrosoftWin32 error messages, see 0x00000005.
Active Directory authentication of the 'ENS for Storage' service account to the filer doesn't succeed.
Back to top
Win32: 0x6a6
The following error messages display inStorageProtection_Debug.log or EndpointSecurityPlatform_Errors.log :
Error FilerServer::DisconnectFromFiler : Exception 0x6a6 (1702) reported while trying to disconnect from filer: x.x.x.x.
RPC_S_INVALID_BINDING
The binding handle is invalid.
MicrosoftWin32 error messages, see 0x000006A6.
The ENSSP scanner tries to deregister with the filer, but can't communicate via the RPC protocol to the filer because of one of the following:
Win32: 0x6ba
The following error messages display inStorageProtection_Debug.log or EndpointSecurityPlatform_Errors.log :
Error FilerServer::ContactFiler() exception 0x6ba (1722) reported while trying to register with filer [x.x.x.x]
RPC_S_SERVER_UNAVAILABLE
The RPC server is unavailable.
MicrosoftWin32 error messages, see 0x000006BA.
The ENSSP scanner tries to register with the filer, but can't communicate via the RPC protocol to the filer because of one of the following:
Win32: 0x6be
The following error messages display inStorageProtection_Debug.log or EndpointSecurityPlatform_Errors.log :
Error FilerServer::KeepAliveProbe : Exception 0x6be (1726) reported while trying to check filer connection to: x.x.x.x
RPC_S_CALL_FAILED
The remote procedure call failed.
MicrosoftWin32 error messages, see 0x000006be.
The ENSSP scanner can't communicate via the RPC protocol to the filer. The problem lies in a component that ENSSP depends on, in this case, Microsoft DCERPC.
Back to top
NetApp ONTAP Product: DAT Update
The following error messages display in the NetApp ONTAP Log (messages):
CIFS: Virus scan server \\SCANNER (x.x.x.x) notified the filer that its version has changed.
The ENSSP scanner notifies the filer that the ENSSP scanner has a new DAT version. This output isn't an error.
Back to top
NetApp ONTAP Product: vscan abort_timeout
The following error messages display in theNetApp ONTAP Log (messages):
CIFS: Virus scan request to x.x.x.x for file ONTAP_ADMIN$\vol\path\filename.ext timed out. Vscan abort_timeout setting exceeded. Filer will retry this request on other vscan servers, if possible.
This error message might be followed by the message below:
CIFS: Virus scan request to x.x.x.x for file ONTAP_ADMIN$\vol\path\filename.ext timed out. Vscan abort_timeout setting exceeded. Vscan abort_timeout setting exceeded. Too many consecutive virus scan requests timed out, breaking connection.
CIFS: Vscan server \\SCANNER deregistered and will be removed from the list of available vscan servers.
This message is a filer'vscan abort_timeout' message that must never occur.
Back to top
NetBIOS Session Service: 0x23
The following error messages display in theNetApp ONTAP Log (messages):
CIFS: Vscan server \\SCANNER registered with the filer successfully. Followed by: NBT: Cannot connect to server x.x.x.x over NBSS socket for port 139. Error 0x23: Resource temporarily unavailable.
CIFS: Warning for server \\SCANNER: Could not make TCP connection.
CIFS: Error for server \\SCANNER: Error while negotiating protocol with server No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS.
CIFS: An attempt to connect to vscan server \\SCANNER failed [0xc000005e].
This message is followed by the message below:
CIFS: Virus scan server \\SCANNER (x.x.x.x) has disconnected from the filer.
The 'NetBIOS over TCP/IP' protocol is either not enabled on the ENSSP scanner or some of its ports are firewalled along the network path or on the ENSSP scanner.
Back to top
NetBIOS Session Service: 0x80
The following error messages display in theNetApp ONTAP Log:
CIFS: Vscan server \\SCANNER registered with the filer successfully.
This message is followed by the message below:
NBT: Cannot connect to server 160.128.15.132 over NBSS socket for port 139. Session setup error. Error 0x80: Server not listening on called name.
CIFS: Warning for server \\SCANNER: Could not make TCP connection.
CIFS: Error for server \\SCANNER: Error while negotiating protocol with server No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS.
CIFS: An attempt to connect to vscan server \\SCANNER failed [0xc000005e]. Followed by: CIFS: Virus scan server \\SCANNER (x.x.x.x) has disconnected from the filer.
The 'File and Printer Sharing' protocol is either not enabled on the ENSSP scanner or some of its ports are firewalled along the network path or on the ENSSP scanner.
Back to top
Win32 : 0x6
The following error messages display in theNetApp ONTAP Log:
CIFS: Possible Virus Detected - File ONTAP_ADMIN$\vol\path\filename.ext in share Sharename modified by client x.x.x.x (Computername) running as user Username may be infected. The filer received status message File threatened. The file could not be deleted, the file is still threatened. and error code [0x6] from vscan (anti-virus) server x.x.x.x.
ERROR_INVALID_HANDLE
The handle is invalid.
MicrosoftWin32 error messages, see 0x00000006.
The ENSSP scanner is configured to delete uncleanable infections, but can't delete an uncleanable file on the filer's file system.
Read-only snapshots must be excluded, but a missing exclusion on the filer might exist.
Back to top
Win32 : 0xa
The following error messages display in theNetApp ONTAP Log:
CIFS: Possible Virus Detected - File ONTAP_ADMIN$\vol\path\filename.ext in share Sharename accessed by client x.x.x.x (Computername) running as user Username may be infected. The filer received status message Error reading file, the scanner does not have rights to open/read file. and error code [0xa] from vscan (anti-virus) server x.x.x.x.
ERROR_BAD_ENVIRONMENT
The environment is incorrect.
MicrosoftWin32 error messages, see 0x0000000A.
The ENSSP scanner doesn't have needed permissions to access the file on the filer's file system.
Read-only snapshots must be excluded, but a missing exclusion on the filer might exist.
Back to top
Win32: 0xb
The following error messages display in theNetApp ONTAP Log:
CIFS: Possible Virus Detected - File ONTAP_ADMIN$\vol\path\filename.ext in share Sharename accessed by client x.x.x.x (Computername) running as user Username may be infected. The filer received status message Error, file not found. and error code [0xb] from vscan (anti-virus) server x.x.x.x.
ERROR_BAD_FORMAT
An attempt is made to load a program with an incorrect format.
MicrosoftWin32 error messages, see 0x0000000B.
The ENSSP scanner can't locate the file on the filer's file system.
Back to top
Win32 : 0xc
The following error messages display in theNetApp ONTAP Log:
CIFS: Possible Virus Detected - File ONTAP_ADMIN$\vol\path\filename.ext in share Sharename accessed by client x.x.x.x (Computername) running as user Username may be infected. The filer received status message Error the file is locked and could not be scanned. and error code [0xc] from vscan (anti-virus) server x.x.x.x.
ERROR_INVALID_ACCESS
The access code is invalid.
MicrosoftWin32 error messages, see 0x0000000C.
The ENSSP scanner can't access the file on the filer's file system because the file is locked.
Back to top
Win32 : 0x11
The following error messages display in theNetApp ONTAP Log:
CIFS: Possible Virus Detected - File ONTAP_ADMIN$\vol\path\filename.ext in share Sharename accessed by client x.x.x.x (Computername) running as user Username may be infected. The filer received status message The scan exceeded the maximum scan time allowed and error code [0x11] from vscan (anti-virus) server x.x.x.x.
ERROR_NOT_SAME_DEVICE
The system can't move the file to a different disk drive.
MicrosoftWin32 error messages, see 0x00000011.
The ENSSP Timeout is exceeded by the ENSSP scanner while scanning the file.
Back to top
Win32 : 0x14
The following error messages display in theNetApp ONTAP Log:
CIFS: Scan request of ONTAP_ADMIN$\vol\path\filename.ext by vscan server \\SCANNER was rejected with error [0x14].
This message is followed by the message below:
CIFSRPC: An RPC exception with a server of type vscan server occurred.
CIFS: Attempt to make a scan request to vscan server \\SCANNER failed with error [0xc002001b] (RPC_NT_CALL_FAILED).
CIFS: Warning for server \\SCANNER: Connection terminated.
CIFS: Virus scan server \\SCANNER (x.x.x.x) has disconnected from the filer. Followed by: CIFS: Vscan server \\SCANNER registered with the filer successfully.
ERROR_BAD_UNIT
The system can't find the device specified.
MicrosoftWin32 error messages, see 0x00000014.
This output is caused by one of the following:
Win32 : 0xaa
The following error messages display in theNetApp ONTAP Log:
CIFS: Scan request of ONTAP_ADMIN$\vol\path\filename.ext by vscan server \\SCANNER was rejected with error [0xaa].
ERROR_BUSY
The requested resource is in use.
MicrosoftWin32 error messages, see 0x000000AA.
The 'Trellix McShield' service (ENS 10.x + ENSSP 2.x) on the ENSSP scanner is either offline, unresponsive, or unreachable.
Back to top
NTSTATUS : 0xC0000022
The following error messages display in theNetApp ONTAP Log:
CIFS: An attempt to connect to vscan server \\SCANNER failed [0xc0000022].
STATUS_ACCESS_DENIED
Access Denied - A process requests access to an object, but isn't granted access rights.
MicrosoftNTSTATUS error messages, see 0xC0000022.
Active Directory authentication of the filer to the ENSSP scanner doesn't succeed because permissions are inadequate.
Back to top
NTSTATUS : 0xC000005E
The following error messages display in theNetApp ONTAP Log:
CIFS: An attempt to connect to vscan server \\SCANNER failed [0xc000005e].
STATUS_NO_LOGON_SERVERS
No logon servers are currently available to service the logon request.
MicrosoftNTSTATUS error messages, see 0xC000005E.
Active Directory authentication of the filer to the ENSSP scanner doesn't succeed because the Active Directory is either offline, unresponsive, or unreachable. Or, the filer can't contact the scanner because permissions on the scanner are inadequate due to misconfiguration of Microsoft Windows appropriate to its role on the scanner node.
In the filer's 'messages' log, this error often follows shortly after other meaningful errors and serves as a general indicator that the filer can't contact the scanner.
Back to top
NTSTATUS : 0xC00000B5
The following error messages display in theNetApp ONTAP Log:
CIFS: An attempt to connect to vscan server \\SCANNER failed [0xc00000b5].
STATUS_IO_TIMEOUT
The specified I/O operation isn't completed before the time-out period expires.
MicrosoftNTSTATUS error messages, see 0xC00000B5.
This error message is symptomatic of filer or scanner misconfiguration and isn't helpful in and of itself. It's accompanied by other, more meaningful contemporaneousNTSTATUS messages.
Back to top
NTSTATUS : 0xC00000BD
The following error messages display in theNetApp ONTAP Log:
CIFS: An attempt to connect to vscan server \\SCANNER failed [0xc00000bd].
STATUS_DUPLICATE_NAME
A duplicate name exists on the network.
MicrosoftNTSTATUS error messages, see 0xC00000BD.
There are multiple possible causes for this error:
NTSTATUS : 0xC0000140
The following error messages display in theNetApp ONTAP Log:
CIFS: An attempt to connect to vscan server \\SCANNER failed [0xc0000140].
STATUS_INVALID_CONNECTION
The connection handle that's given to the transport is invalid.
MicrosoftNTSTATUS error messages, see 0xC0000140.
The Windows 6.x scanner has SMB2 enabled and the filer implements, but doesn't adequately support SMB2.
Back to top
NTSTATUS : 0xC0020052
The following error messages display in theNetApp ONTAP Log:
CIFS: Vscan server \\SCANNER deregistered and will be removed from the list of available vscan servers.
This message is followed by the message below:
CIFS: Attempt to make a scan request to vscan server \\SCANNER failed with error [0xc0020052] (RPC_NT_COMM_FAILURE). Followed by: CIFS: Vscan server \\SCANNER registered with the filer successfully. RPC_NT_COMM_FAILURE
A communications failure occurred during an RPC.
MicrosoftNTSTATUS error messages, see 0xC0020052.
The filer tries to send a scan request to a ENSSP scanner already deregistered.
Back to top
StorageProtection_Activity.log StorageProtection_Debug.log EndpointSecurityPlatform_Errors.log
CAUTION: This article contains information about opening or modifying the registry.
- The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
- Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see the Microsoft Windows registry information for advanced users article.
- Do not run a REG file that is not confirmed to be a genuine registry import file.
There are several messages covered in this article. Use the following links to go to the relevant section of this article, or external website, as per your needs.
- ENSSP Logs:
- ENSSP product messages: Defined in ENSSP product documentation or internal documentation.
- Microsoft
Win32 error messages - ENSSP Product: Config::SetScanThreadPriority, g_hReloadDAT_Mutex
- ENSSP Product: RPC Scan 'Result Status' Codes
- ENSSP Product: ScanThread did not start as expected
- ENSSP Product: Server is at max connections
- ENSSP Product: EngineServerDied, Unable to init scanner, Invalid scanner
- ENSSP Product: The file was not scanned. This is usually caused by an extension check
Win32 : 0x5Win32 : 0x6a6Win32 : 0x6baWin32 : 0x6be
NetApp ONTAP Log (messages):NetApp ONTAP product messages: Defined in theNetApp ONTAP product documentation or internal documentation.NetBIOS messagesMicrosoftWin32 error messages- Microsoft
NTSTATUS error messages NetApp ONTAP Product: DAT UpdateNetApp ONTAP Product: vscan abort_timeoutNetBIOS Session Service: 0x23NetBIOS Session Service: 0x80Win32 : 0x6Win32 : 0xaWin32 : 0xbWin32 : 0xcWin32 : 0x11Win32 : 0x14Win32 : 0xaaNTSTATUS : 0xC0000022NTSTATUS : 0xC000005ENTSTATUS : 0xC00000B5NTSTATUS : 0xC00000BDNTSTATUS : 0xC0000140NTSTATUS : 0xC0020052
ENSSP Product:
The following error messages display in
At the ENSSP ICAP scanner startup:
Warning ICAPConfig::SetMaxConnections : 130
At the ENSSP
Error $$$$NetAppScannerPlugIn$$$ g_hReloadDAT_Mutex event open 0 2
Error $$$$NetAppScannerPlugIn$$$ g_hReloadDAT_Mutex event creation 370 0
Error $$$$NetAppScannerPlugIn$$$ g_hReloadENG_Mutex event open 0 2
Error $$$$NetAppScannerPlugIn$$$ g_hReloadENG_Mutex event creation 374 0
At the ENSSP scanner shutdown:
Error $$$$NetAppScannerPlugIn$$$ g_hReloadDAT_Mutex event creation 374 0
Error $$$$NetAppScannerPlugIn$$$ g_hReloadENG_Mutex event open 0 2
Error $$$$NetAppScannerPlugIn$$$ g_hReloadENG_Mutex event creation 370 0
This output isn't an error; these messages are normal ENSSP scanner startup and shutdown messages.
Back to top
ENSSP Product: RPC Scan 'Result Status' Codes
The following error messages display in
Or
Or
[0] - scanned file is clean, excluded, or repaired
[5] - scanned file is deleted
[6] - file deletion could not be accomplished
[10] - insufficient permission to access the file
[11] - file is not found
[12] - file could not be scanned because of a sharing violation
[17] - scan timed out
[18] - file could not be scanned because of an unspecified error
Back to top
ENSSP Product: ScanThread did not start as expected
The following error messages display in
Error ERROR: ScanThread did not start as expected.
Warning ScanThreadManager::GetAvailableScanThread : Invalid scanner [NetAppScanner].
The ENSSP scanner is unable to obtain a ENS scan thread for the ENSSP scan request.
Back to top
ENSSP Product: Server is at max connections
The following error message displays in
The configured ENSSP scan thread count is insufficient to handle the number of incoming scan requests.
Back to top
ENSSP Product: EngineServerDied, Unable to init scanner, Invalid scanner
The following error messages display in
Error EngineWrapper GetScanner: Error, unable to init scanner.
Error ScannerWrapper Constructor: invalid scanner
Warning ScanThreadManager::GetAvailableScanThread : Invalid scanner [NetAppScanner] .
Warning ScanProvider::ScanRequest unable to handle scan request all scanners currently in use. - file \\?\UNC\x.x.x.x\path\filename.ext
Warning NetAppScannerPlugIn::VS_ScanRequest File="path\filename.ext" Too busy to handle request.
The 'Trellix McShield' service (ENS 10.x + ENSSP 2.x) is either offline, unresponsive, or unreachable.
Back to top
ENSSP Product: The file was not scanned. This is usually caused by an extension check
The following error messages display in
This error message makes only one statement with certainty; the file isn't scanned. The most likely reason is that this message is as-designed because the ENSSP policy 'NetApp Policies' has been defined with one or more exclusions.
The file that's sent for scanning matches an exclusion, so ENSSP doesn't scan the file, logs this message, and sends a 'clean' result for that file to the appliance. If no exclusion that matches the file is present, this error message means that the file isn't scanned. No cause can be attributed without the ENSSP
Back to top
Win32: 0x5
The following error messages display in
ERROR_ACCESS_DENIED
Access is denied.
Microsoft
Active Directory authentication of the 'ENS for Storage' service account to the filer doesn't succeed.
Back to top
Win32: 0x6a6
The following error messages display in
RPC_S_INVALID_BINDING
The binding handle is invalid.
Microsoft
The ENSSP scanner tries to deregister with the filer, but can't communicate via the RPC protocol to the filer because of one of the following:
- The filer is offline or unresponsive when the ENSSP scanner tries deregistration.
- The problem is with a component that ENSSP depends on, in this case, Microsoft DCERPC.
Win32: 0x6ba
The following error messages display in
RPC_S_SERVER_UNAVAILABLE
The RPC server is unavailable.
Microsoft
The ENSSP scanner tries to register with the filer, but can't communicate via the RPC protocol to the filer because of one of the following:
- The filer is offline or unresponsive when the ENSSP scanner tries registration.
- The problem is with a component that ENSSP depends on, in this case, Microsoft DCERPC.
Win32: 0x6be
The following error messages display in
RPC_S_CALL_FAILED
The remote procedure call failed.
Microsoft
The ENSSP scanner can't communicate via the RPC protocol to the filer. The problem lies in a component that ENSSP depends on, in this case, Microsoft DCERPC.
Back to top
The following error messages display in the NetApp ONTAP Log (messages):
The ENSSP scanner notifies the filer that the ENSSP scanner has a new DAT version. This output isn't an error.
Back to top
The following error messages display in the
This error message might be followed by the message below:
CIFS: Vscan server \\SCANNER deregistered and will be removed from the list of available vscan servers.
This message is a filer
Back to top
The following error messages display in the
CIFS: Warning for server \\SCANNER: Could not make TCP connection.
CIFS: Error for server \\SCANNER: Error while negotiating protocol with server No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS.
CIFS: An attempt to connect to vscan server \\SCANNER failed [0xc000005e].
This message is followed by the message below:
The '
Back to top
The following error messages display in the
This message is followed by the message below:
CIFS: Warning for server \\SCANNER: Could not make TCP connection.
CIFS: Error for server \\SCANNER: Error while negotiating protocol with server No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS.
CIFS: An attempt to connect to vscan server \\SCANNER failed [0xc000005e]. Followed by:
The 'File and Printer Sharing' protocol is either not enabled on the ENSSP scanner or some of its ports are firewalled along the network path or on the ENSSP scanner.
Back to top
The following error messages display in the
ERROR_INVALID_HANDLE
The handle is invalid.
Microsoft
The ENSSP scanner is configured to delete uncleanable infections, but can't delete an uncleanable file on the filer's file system.
Read-only snapshots must be excluded, but a missing exclusion on the filer might exist.
Back to top
The following error messages display in the
ERROR_BAD_ENVIRONMENT
The environment is incorrect.
Microsoft
The ENSSP scanner doesn't have needed permissions to access the file on the filer's file system.
Read-only snapshots must be excluded, but a missing exclusion on the filer might exist.
Back to top
Win32: 0xb
The following error messages display in the
ERROR_BAD_FORMAT
An attempt is made to load a program with an incorrect format.
Microsoft
The ENSSP scanner can't locate the file on the filer's file system.
Back to top
The following error messages display in the
ERROR_INVALID_ACCESS
The access code is invalid.
Microsoft
The ENSSP scanner can't access the file on the filer's file system because the file is locked.
Back to top
The following error messages display in the
ERROR_NOT_SAME_DEVICE
The system can't move the file to a different disk drive.
Microsoft
The ENSSP Timeout is exceeded by the ENSSP scanner while scanning the file.
Back to top
The following error messages display in the
This message is followed by the message below:
CIFS: Attempt to make a scan request to vscan server \\SCANNER failed with error [0xc002001b] (RPC_NT_CALL_FAILED).
CIFS: Warning for server \\SCANNER: Connection terminated.
CIFS: Virus scan server \\SCANNER (x.x.x.x) has disconnected from the filer. Followed by:
ERROR_BAD_UNIT
The system can't find the device specified.
Microsoft
This output is caused by one of the following:
- Without informing the
vscan component of the filer operating system, thecifs.rpcfd component of the filer operating system closes the RPC connection that the ENSSP scanner uses. This action prevents proper communication from the ENSSP scanner to the filer. - The ENSSP scanner is overloaded with scan requests.
- The ENSSP scanner can't determine from the file path of the scan request which filer originated the scan request.
The following error messages display in the
ERROR_BUSY
The requested resource is in use.
Microsoft
The 'Trellix McShield' service (ENS 10.x + ENSSP 2.x) on the ENSSP scanner is either offline, unresponsive, or unreachable.
Back to top
The following error messages display in the
STATUS_ACCESS_DENIED
Access Denied - A process requests access to an object, but isn't granted access rights.
Microsoft
Active Directory authentication of the filer to the ENSSP scanner doesn't succeed because permissions are inadequate.
Back to top
The following error messages display in the
STATUS_NO_LOGON_SERVERS
No logon servers are currently available to service the logon request.
Microsoft
Active Directory authentication of the filer to the ENSSP scanner doesn't succeed because the Active Directory is either offline, unresponsive, or unreachable. Or, the filer can't contact the scanner because permissions on the scanner are inadequate due to misconfiguration of Microsoft Windows appropriate to its role on the scanner node.
In the filer's 'messages' log, this error often follows shortly after other meaningful errors and serves as a general indicator that the filer can't contact the scanner.
Back to top
The following error messages display in the
STATUS_IO_TIMEOUT
The specified I/O operation isn't completed before the time-out period expires.
Microsoft
This error message is symptomatic of filer or scanner misconfiguration and isn't helpful in and of itself. It's accompanied by other, more meaningful contemporaneous
Back to top
The following error messages display in the
STATUS_DUPLICATE_NAME
A duplicate name exists on the network.
Microsoft
There are multiple possible causes for this error:
- There might be another, conflicting IP address defined in DNS or on the local HOSTS file with a CNAME, A, or AAAA record that matches the storage appliance's or VSES scanner's DNS host name. This fact confuses the DNS resolution.
CNAME: Canonical Name DNS record
A record: IPv4 address DNS record
AAAA record: IPv6 address DNS record- Avoid use of HOSTS files as they quickly become stale, and are easily forgotten.
- Check the storage appliance and ENSSP scanner's HOSTS files and make sure that no duplicate names that match a record in the Active Directory DNS exist.
- Check the Active Directory DNS to make sure that forward and reverse lookup of IP addresses for storage appliances and ENSSP scanners doesn't inadvertently disclose non-appliance and non-scanner hosts using those DNS names.
- The storage appliance tries to communicate with the scanner using a DNS host name that the ENSSP scanner doesn't recognize.
A CNAME, A record, or AAAA DNS record with the proper IP address (but an unexpected host name) for the ENSSP scanner might exist in DNS or the local HOSTS file.
The ENSSP scanner might not accept traffic if addressed by an unexpected host name instead of by its self-recognized DNS host name. This situation often occurs at the SMBTreeConnect phase.- Avoid the use of HOSTS files as they quickly become stale and are easily forgotten.
- Use IP addresses, not DNS host names, to configure the storage appliance and ENSSP scanner addresses in their respective policies.
Kerberos uses Active Directory DNS even if no other protocols use it; so, making sure that DNS records are correct is mandatory. - Or, if a CNAME or alternative DNS host name is used to address the ENSSP scanner, you might try adding the following registry value and rebooting:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters REG_MULTI_SZ OptionalNames "AlternativeCNAMEOrHostname"
Here,AlternativeCNAMEOrHostname is one or more alternative host names separated by a line feed character (if inregedit.exe , use a carriage return).
If it's unknown what DNS names are being used to address the scanner, Windows can permit incoming packets using any DNS name by adding the following registry value and rebooting:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters REG_DWORD DisableStrictNameChecking "1"
- If a storage appliance doesn't respond to the ENSSP scanner's RPC ping every 30 seconds, a ENSSP scanner might close the RPC session with the storage appliance. It then tries to re-register with the storage appliance using a new RPC session. The following behaviors occur:
- The storage appliance might not realize that the ENSSP scanner has closed the RPC session.
- The storage appliance doesn't de-register the ENSSP scanner.
- The storage appliance continues to send traffic to the ENSSP scanner on the closed RPC session.
- The ENSSP scanner rejects the storage appliance's traffic on the closed RPC session. Simultaneously, the storage appliance rejects the ENSSP scanner's attempts to re-register.
- The storage appliance believes that it already has an RPC session with the ENSSP scanner (the closed RPC session).
- The storage appliance logs this error, believing that the ENSSP scanner is an imposter.
- The storage appliance also logs
Win32 error 0x14 because of the traffic it's sending to the ENSSP scanner on the closed RPC session.
This scenario is experienced when de-duplication and NDMP backup are simultaneously run on a storage appliance. It has been identified as a vendor defect, and can be worked around by rescheduling de-duplication and NDMP backups to different times until the vendor creates a fix.
The following error messages display in the
STATUS_INVALID_CONNECTION
The connection handle that's given to the transport is invalid.
Microsoft
The Windows 6.x scanner has SMB2 enabled and the filer implements, but doesn't adequately support SMB2.
Back to top
The following error messages display in the
This message is followed by the message below:
A communications failure occurred during an RPC.
Microsoft
The filer tries to send a scan request to a ENSSP scanner already deregistered.
Back to top
Affected Products
Languages:
This article is available in the following languages: