none
Event Id 5137 (SharePoint Real Time scan exceeded the allowed scan time limit.) and 2054 (Scan/Clean document failed due to timeout error) RRS feed

  • Question

  • We are frequently receiving the following error messages and users are having problem uploading their content:

     FSCController Event id 5137 SharePoint Real Time scan exceeded the allowed scan time limit.
     
     FSSPController Event id 2054 Scan/Clean document failed due to timeout error

    These are false positives as there are no viruses and the file sizes are not large enough to warrant a time out.

    We are running MOSS 2007 with Service Pack 2 (v. 12.0.6535.5002) with two WFEs in a load balanced configuration.  Both WFEs are displaying the errors at different times for different files, and the files that they are choking on are typically small files (<1MB) that should not be timing out.  There doesn't seem to be a noticeable pattern - sometimes they are PDFs (sometimes consisting of scanned images, sometimes not), sometimes they are .msg files (very small, pure text).

    Our "Realtime Antivirus configuration settings" in Central Admin are:
    *Scan documents on upload
    *Attempt to clean infected documents
    *Time out scanning after 60 seconds
    *Allow scanner to use up to 10 threads

    Note that we doubled these values in an attempt to mitigate the issue (went from 30 seconds and 5 threads).

    Our Forefront scanning settings look like this:

    An example of what shows up in the Forefront Program Log during one of these incidents:

    Tue Mar 22 18:59:15 2011 ( 5032- 1392), "DIAGNOSTICS: Aborting realtime. Index = 0x0, GUID = {9DA140C3-D13C-4E69-A45C-3B1C07944EFB}"
    Tue Mar 22 18:59:15 2011 ( 1272- 1340), "ERROR: SharePoint Realtime scan exceeded the allowed scan time limit."
    Tue Mar 22 18:59:15 2011 ( 1272- 1340), "DIAGNOSTIC: Terminating SharePoint Realtime scanner process PID 4324, index 0"
    Tue Mar 22 18:59:15 2011 ( 3936- 4336), "DIAGNOSTIC: launcher.cpp::wWinMain(): Launching process as LocalSystem."
    Tue Mar 22 18:59:15 2011 ( 1272- 1340), "*******************SharePoint Realtime Process Table********************"
    Tue Mar 22 18:59:15 2011 ( 1272- 1340), "INFORMATION: Reatime Process Index 0 -- PID 5084-- GUID {CAA0E706-0053-4EAA-B6E5-F4D7ACD135D8}"
    Tue Mar 22 18:59:15 2011 ( 1272- 1340), "INFORMATION: Reatime Process Index 1 -- PID 3456-- GUID {706DD94A-9942-4F69-8A31-74317E3CC640}"
    Tue Mar 22 18:59:15 2011 ( 1272- 1340), "INFORMATION: Reatime Process Index 2 -- PID 2236-- GUID {531F3E92-EC60-466D-B088-70F05D79C965}"
    Tue Mar 22 18:59:16 2011 ( 5084- 4144), "INFORMATION: Realtime Scanner Index 0"
    Tue Mar 22 18:59:17 2011 ( 5032- 3100), "ERROR: Scan/Clean document Attmnts, Exhibits, Appendix 01.pdf failed due to timeout error"
    Tue Mar 22 18:59:17 2011 ( 5084- 4144), "INFORMATION: Realtime scan enabled."
    Tue Mar 22 18:59:27 2011 ( 5084- 4872), "INFORMATION: AVE multi engine manager enabled for Realtime scanner "

    It looks like the thread running the process that was scanning that document terminated?


    When I correlate that against the MOSS ULS logs, I see this:

    03/22/2011 18:59:17.51     w3wp.exe (0x13A8)                           0x1338    Windows SharePoint Services       General                           72p2    High        #96000a: infected by "Virus scan timeout -- Please contact administrator to increase max scan time and try again." - DOMAIN1\THD1 - Shared Documents/Prior Art to be reviewed/From Katz 134 file history/Attmnts, Exhibits, Appendix 01.pdf     
    03/22/2011 18:59:17.51     w3wp.exe (0x13A8)                           0x1338    Windows SharePoint Services       General                           8k4t    High        #20007: Cannot remove file "13A81338A9664D478137FAA380A8B92C_1.tmp". Error Code: 32.     
    03/22/2011 18:59:17.51     w3wp.exe (0x13A8)                           0x1338    Windows SharePoint Services       General                           8k4t    High        (#32: Cannot remove file "13A81338A9664D478137FAA380A8B92C_1.tmp". Error Code: 32.)     

    WFE #1:
    ForeFront Administrator
    Version: 10.2.0945.0
    Service Pack: 3
    Operating System: Windows NT Version 6.1, Build number 7600
    Operating System Service Pack: No Service Pack Installed
    Processor: Intel processor
    Number of Processors: 4
    Total Physical Memory: 17179336 KBytes
    Available Physical Memory: 12944347 KBytes
    Temporary Directory Being Used: C:\Users\erm5a\AppData\Local\Temp\2\
    Available Space on Drive C:\ : 8221232 KBytes
    Available Space on Drive D:\ : 35906964 KBytes
    Available Space on Drive F:\ : 41362084 KBytes

    Forefront Server
    Version: 10.2.0945.0(Subscription)
    Service Pack: 3
    Licensed Components:
    Component    License Type    Expiration Date
    Forefront    Subscription        Wednesday, August 07, 2013
    Incidents Database Locale: English (United States)
    Quarantine Database Locale: English (United States)
    SharePoint Version: 12.0.6535.5002
    Operating System: Windows NT Version 6.1, Build number 7600
    Operating System Service Pack: No Service Pack Installed
    Processor: Intel processor
    Number of Processors: 4
    Total Physical Memory: 17179336 KBytes
    Available Physical Memory: 12944351 KBytes
    Temporary Directory Being Used: C:\Windows\Temp\
    Available Space on Drive C:\ : 8221232 KBytes
    Available Space on Drive D:\ : 35906964 KBytes
    Available Space on Drive F:\ : 41362084 KBytes

    WFE#2
    ForeFront Administrator
    Version: 10.2.0945.0
    Service Pack: 3
    Product ID:
    Operating System: Windows NT Version 6.1, Build number 7600
    Operating System Service Pack: No Service Pack Installed
    Processor: Intel processor
    Number of Processors: 4
    Total Physical Memory: 17179336 KBytes
    Available Physical Memory: 13100228 KBytes
    Temporary Directory Being Used: C:\Users\erm5a\AppData\Local\Temp\2\
    Available Space on Drive C:\ : 8076484 KBytes
    Available Space on Drive D:\ : 37434428 KBytes
    Available Space on Drive F:\ : 41365324 KBytes

    Forefront Server
    Version: 10.2.0945.0(Subscription)
    Service Pack: 3
    Product ID: 89132-005-2000023-60100
    Licensed Components:
    Component    License Type    Expiration Date
    Forefront    Subscription        Wednesday, August 07, 2013
    Incidents Database Locale: English (United States)
    Quarantine Database Locale: English (United States)
    SharePoint Version: 12.0.6535.5002
    Operating System: Windows NT Version 6.1, Build number 7600
    Operating System Service Pack: No Service Pack Installed
    Processor: Intel processor
    Number of Processors: 4
    Total Physical Memory: 17179336 KBytes
    Available Physical Memory: 13100228 KBytes
    Temporary Directory Being Used: C:\Windows\Temp\
    Available Space on Drive C:\ : 8076484 KBytes
    Available Space on Drive D:\ : 37434428 KBytes
    Available Space on Drive F:\ : 41365324 KBytes

    Any help or suggestions greatly appreciated!


    Thanks,

    Eric

    Wednesday, March 23, 2011 5:33 PM

All replies

  • I still need help, but this is an update -

    I was able to recreate this issue with a user.  They had a 7.5MB word document that was getting this error message about the anti-virus timing out.  I uploaded the file with a stopwatch running, and noted that it threw the error after 60 seconds -- that is expected given the Central Admin anti-virus settings above.  I upped the "Time out scanning after X seconds" in Central Admin to 600 seconds (10 minutes!) and it still would never upload the file, it would do a different type of error after 2 minutes where the file upload progress bar would just never really get anywhere (the status bar in the browser using a browser-based upload, and tried dragging/dropping using Windows Explorer on the doc library and the time estimated to copy would just never go anywhere really).  It had very strange behavior, one time it succeeded in uploading the file even though there was an error message, and second time the file was there and then disappeared.

    I turned off the antivirus in Central Admin by unchecking "*Scan documents on upload" in Central Admin and the document uploaded in less that 2 seconds with no problems.

    Now, I have a theory that there's something about embedded OLE objects in documents that are causing problems for Forefront but I don't know how to test it.  This Word doc (a 2003 document, not a docx) had a number of embedded images/files from a program called ChemDraw.  They show up as images when you open Word and don't need ChemDraw installed, but I noticed when I single-click on the image I got a "Double-click to edit CS ChemDraw Drawing" in the Word status bar.  When I right-click on the image, I get an option under Paste Options (I'm in Office 2010) "CS ChemDraw Drawing Object > Convert..." and if I select Convert I have a dialogue menu that doesn't do anything for me (presumably because I don't have ChemDraw installed) but it indicated that the "Current Type" = "CS ChemDraw Drawing" so I think this as an OLE object and not a bitmap or something and this is the source of the issue -- when I double-click, I get a "the server application, source file, or item cannot be found - make sure the application is properly installed" error message.  Is there anyone from the Forefront product team watching this forum that may have some suggestions?  Do I need to install some kind of ChemDraw reader on the WFEs and Indexer for these files to not crash Forefront?  It is not an acceptable solution to have users save files as images instead of doing whatever they're doing because this is an extranet scenario where we cannot control or place limits on how external users are working.


    Monday, March 28, 2011 7:29 PM
  • 14000 views and no replies.  OK....

    I had to turn Anti-Virus off to enable our users to continue to use the site.  If someone has any suggestions or answers, please feel to share!


    Thanks!

    Friday, April 1, 2011 4:53 PM
  • Not sure if this has been resolved for you.

     

    But i had the same problem and couldn't find anything about a fix.

     

    What i ended up doing was reboot my webserver ( which was reporting the error). This didnt solve the problem. I then rebooted my app server. This seemed to fix the problem.

    Hope this helps.

    Ant

     

    Thursday, April 14, 2011 2:02 PM
  • Hi Eric/Ant,

    This could be occurring for a number of reasons such as:-

    1) a problem with Forefront integration (use fscutility disable/enable to recreate this)

    2) a faulty engine (rename the engine folders one by one, updating each one after renaming it and confirming it has updated successfully)

    3) an issue with a particular file type (install the latest RU - http://technet.microsoft.com/en-us/forefront/ff899332.aspx)

    these are probably the most common causes of this issue.

    Hope this helps,

    Alex

    Thursday, January 12, 2012 4:13 PM