Event Id 5137 (SharePoint Real Time scan exceeded the allowed scan time limit.) and 2054 (Scan/Clean document failed due to timeout error)
-
Wednesday, March 23, 2011 5:33 PM
We are frequently receiving the following error messages and users are having problem uploading their content:
FSCController Event id 5137 SharePoint Real Time scan exceeded the allowed scan time limit.
FSSPController Event id 2054 Scan/Clean document failed due to timeout errorThese are false positives as there are no viruses and the file sizes are not large enough to warrant a time out.
We are running MOSS 2007 with Service Pack 2 (v. 12.0.6535.5002) with two WFEs in a load balanced configuration. Both WFEs are displaying the errors at different times for different files, and the files that they are choking on are typically small files (<1MB) that should not be timing out. There doesn't seem to be a noticeable pattern - sometimes they are PDFs (sometimes consisting of scanned images, sometimes not), sometimes they are .msg files (very small, pure text).
Our "Realtime Antivirus configuration settings" in Central Admin are:
*Scan documents on upload
*Attempt to clean infected documents
*Time out scanning after 60 seconds
*Allow scanner to use up to 10 threadsNote that we doubled these values in an attempt to mitigate the issue (went from 30 seconds and 5 threads).
Our Forefront scanning settings look like this:
An example of what shows up in the Forefront Program Log during one of these incidents:
Tue Mar 22 18:59:15 2011 ( 5032- 1392), "DIAGNOSTICS: Aborting realtime. Index = 0x0, GUID = {9DA140C3-D13C-4E69-A45C-3B1C07944EFB}"
Tue Mar 22 18:59:15 2011 ( 1272- 1340), "ERROR: SharePoint Realtime scan exceeded the allowed scan time limit."
Tue Mar 22 18:59:15 2011 ( 1272- 1340), "DIAGNOSTIC: Terminating SharePoint Realtime scanner process PID 4324, index 0"
Tue Mar 22 18:59:15 2011 ( 3936- 4336), "DIAGNOSTIC: launcher.cpp::wWinMain(): Launching process as LocalSystem."
Tue Mar 22 18:59:15 2011 ( 1272- 1340), "*******************SharePoint Realtime Process Table********************"
Tue Mar 22 18:59:15 2011 ( 1272- 1340), "INFORMATION: Reatime Process Index 0 -- PID 5084-- GUID {CAA0E706-0053-4EAA-B6E5-F4D7ACD135D8}"
Tue Mar 22 18:59:15 2011 ( 1272- 1340), "INFORMATION: Reatime Process Index 1 -- PID 3456-- GUID {706DD94A-9942-4F69-8A31-74317E3CC640}"
Tue Mar 22 18:59:15 2011 ( 1272- 1340), "INFORMATION: Reatime Process Index 2 -- PID 2236-- GUID {531F3E92-EC60-466D-B088-70F05D79C965}"
Tue Mar 22 18:59:16 2011 ( 5084- 4144), "INFORMATION: Realtime Scanner Index 0"
Tue Mar 22 18:59:17 2011 ( 5032- 3100), "ERROR: Scan/Clean document Attmnts, Exhibits, Appendix 01.pdf failed due to timeout error"
Tue Mar 22 18:59:17 2011 ( 5084- 4144), "INFORMATION: Realtime scan enabled."
Tue Mar 22 18:59:27 2011 ( 5084- 4872), "INFORMATION: AVE multi engine manager enabled for Realtime scanner "It looks like the thread running the process that was scanning that document terminated?
When I correlate that against the MOSS ULS logs, I see this:
03/22/2011 18:59:17.51 w3wp.exe (0x13A8) 0x1338 Windows SharePoint Services General 72p2 High #96000a: infected by "Virus scan timeout -- Please contact administrator to increase max scan time and try again." - DOMAIN1\THD1 - Shared Documents/Prior Art to be reviewed/From Katz 134 file history/Attmnts, Exhibits, Appendix 01.pdf
03/22/2011 18:59:17.51 w3wp.exe (0x13A8) 0x1338 Windows SharePoint Services General 8k4t High #20007: Cannot remove file "13A81338A9664D478137FAA380A8B92C_1.tmp". Error Code: 32.
03/22/2011 18:59:17.51 w3wp.exe (0x13A8) 0x1338 Windows SharePoint Services General 8k4t High (#32: Cannot remove file "13A81338A9664D478137FAA380A8B92C_1.tmp". Error Code: 32.)
WFE #1:
ForeFront Administrator
Version: 10.2.0945.0
Service Pack: 3
Operating System: Windows NT Version 6.1, Build number 7600
Operating System Service Pack: No Service Pack Installed
Processor: Intel processor
Number of Processors: 4
Total Physical Memory: 17179336 KBytes
Available Physical Memory: 12944347 KBytes
Temporary Directory Being Used: C:\Users\erm5a\AppData\Local\Temp\2\
Available Space on Drive C:\ : 8221232 KBytes
Available Space on Drive D:\ : 35906964 KBytes
Available Space on Drive F:\ : 41362084 KBytes
Forefront Server
Version: 10.2.0945.0(Subscription)
Service Pack: 3
Licensed Components:
Component License Type Expiration Date
Forefront Subscription Wednesday, August 07, 2013
Incidents Database Locale: English (United States)
Quarantine Database Locale: English (United States)
SharePoint Version: 12.0.6535.5002
Operating System: Windows NT Version 6.1, Build number 7600
Operating System Service Pack: No Service Pack Installed
Processor: Intel processor
Number of Processors: 4
Total Physical Memory: 17179336 KBytes
Available Physical Memory: 12944351 KBytes
Temporary Directory Being Used: C:\Windows\Temp\
Available Space on Drive C:\ : 8221232 KBytes
Available Space on Drive D:\ : 35906964 KBytes
Available Space on Drive F:\ : 41362084 KBytes
WFE#2
ForeFront Administrator
Version: 10.2.0945.0
Service Pack: 3
Product ID:
Operating System: Windows NT Version 6.1, Build number 7600
Operating System Service Pack: No Service Pack Installed
Processor: Intel processor
Number of Processors: 4
Total Physical Memory: 17179336 KBytes
Available Physical Memory: 13100228 KBytes
Temporary Directory Being Used: C:\Users\erm5a\AppData\Local\Temp\2\
Available Space on Drive C:\ : 8076484 KBytes
Available Space on Drive D:\ : 37434428 KBytes
Available Space on Drive F:\ : 41365324 KBytes
Forefront Server
Version: 10.2.0945.0(Subscription)
Service Pack: 3
Product ID: 89132-005-2000023-60100
Licensed Components:
Component License Type Expiration Date
Forefront Subscription Wednesday, August 07, 2013
Incidents Database Locale: English (United States)
Quarantine Database Locale: English (United States)
SharePoint Version: 12.0.6535.5002
Operating System: Windows NT Version 6.1, Build number 7600
Operating System Service Pack: No Service Pack Installed
Processor: Intel processor
Number of Processors: 4
Total Physical Memory: 17179336 KBytes
Available Physical Memory: 13100228 KBytes
Temporary Directory Being Used: C:\Windows\Temp\
Available Space on Drive C:\ : 8076484 KBytes
Available Space on Drive D:\ : 37434428 KBytes
Available Space on Drive F:\ : 41365324 KBytesAny help or suggestions greatly appreciated!
Thanks,Eric
All Replies
-
Monday, March 28, 2011 7:29 PM
I still need help, but this is an update -
I was able to recreate this issue with a user. They had a 7.5MB word document that was getting this error message about the anti-virus timing out. I uploaded the file with a stopwatch running, and noted that it threw the error after 60 seconds -- that is expected given the Central Admin anti-virus settings above. I upped the "Time out scanning after X seconds" in Central Admin to 600 seconds (10 minutes!) and it still would never upload the file, it would do a different type of error after 2 minutes where the file upload progress bar would just never really get anywhere (the status bar in the browser using a browser-based upload, and tried dragging/dropping using Windows Explorer on the doc library and the time estimated to copy would just never go anywhere really). It had very strange behavior, one time it succeeded in uploading the file even though there was an error message, and second time the file was there and then disappeared.
I turned off the antivirus in Central Admin by unchecking "*Scan documents on upload" in Central Admin and the document uploaded in less that 2 seconds with no problems.
Now, I have a theory that there's something about embedded OLE objects in documents that are causing problems for Forefront but I don't know how to test it. This Word doc (a 2003 document, not a docx) had a number of embedded images/files from a program called ChemDraw. They show up as images when you open Word and don't need ChemDraw installed, but I noticed when I single-click on the image I got a "Double-click to edit CS ChemDraw Drawing" in the Word status bar. When I right-click on the image, I get an option under Paste Options (I'm in Office 2010) "CS ChemDraw Drawing Object > Convert..." and if I select Convert I have a dialogue menu that doesn't do anything for me (presumably because I don't have ChemDraw installed) but it indicated that the "Current Type" = "CS ChemDraw Drawing" so I think this as an OLE object and not a bitmap or something and this is the source of the issue -- when I double-click, I get a "the server application, source file, or item cannot be found - make sure the application is properly installed" error message. Is there anyone from the Forefront product team watching this forum that may have some suggestions? Do I need to install some kind of ChemDraw reader on the WFEs and Indexer for these files to not crash Forefront? It is not an acceptable solution to have users save files as images instead of doing whatever they're doing because this is an extranet scenario where we cannot control or place limits on how external users are working.
-
Friday, April 01, 2011 4:53 PM
14000 views and no replies. OK....
I had to turn Anti-Virus off to enable our users to continue to use the site. If someone has any suggestions or answers, please feel to share!
Thanks! -
Thursday, April 14, 2011 2:02 PM
Not sure if this has been resolved for you.
But i had the same problem and couldn't find anything about a fix.
What i ended up doing was reboot my webserver ( which was reporting the error). This didnt solve the problem. I then rebooted my app server. This seemed to fix the problem.
Hope this helps.
Ant
-
Thursday, January 12, 2012 4:13 PM
Hi Eric/Ant,
This could be occurring for a number of reasons such as:-
1) a problem with Forefront integration (use fscutility disable/enable to recreate this)
2) a faulty engine (rename the engine folders one by one, updating each one after renaming it and confirming it has updated successfully)
3) an issue with a particular file type (install the latest RU - http://technet.microsoft.com/en-us/forefront/ff899332.aspx)
these are probably the most common causes of this issue.
Hope this helps,
Alex
.png)
