VNX: CAVA error VC: 3: 32: Server 'x.x.x.x' returned error 'FAIL' when checking file

Summary: Errors in data mover logs indicate that the VC service failed to scan a file

Αυτό το άρθρο ισχύει για Αυτό το άρθρο δεν ισχύει για Αυτό το άρθρο δεν συνδέεται με κάποιο συγκεκριμένο προϊόν. Δεν προσδιορίζονται όλες οι εκδόσεις προϊόντων σε αυτό το άρθρο.
Δείτε άλλους πόρους

Symptoms



While virus checking is running, in the logs an error indicating that the VC service has failed to check it:

2016-03-29 11:38:44: VC: 3: 32: Server 'x.x.x.x' returned error 'FAIL' when checking file '\root_vdm_id\mount_path\filename.ext'

Cause

The 'FAIL' message occurs when a scan request is opened (the VC service on the data mover sends a request to the CAVA servers) and when the CAVA server tries to open it the file is not found.  This means that the file was deleted before it could be scanned.  There are some scenarios where this could happen:
  • One way this occurs is if the file was a cookie, temporary file, or lock file.  Microsoft office, for example, creates temporary files that follow the format ~$<original_filename.xxxx>.  These files normally disappear when the file is saved or closed, and if this happens quickly the file can disappear before it has a chance to be scanned, leading to the FAIL message in the data mover log.  The filenames that are failing scans usually identify this as the source of the issue.
  • Another way this can occur is if the file has a special 'disposition' on it.  In SMB and SMB2 the user can set a disposition 'delete on close' when opening a file.  If the file that is referred for scanning is opened by another user with this disposition set, the file is deleted before it can be scanned, leading to the FAIL message in the data mover logs.  This option can be seen in packet traces by looking at SMB 'Create' or 'SetInfo' calls, but will be set by the user doing the deleting, and probably not the CAVA servers.  This can make things difficult because normal traffic must be monitored (not just the AV server) to determine who is setting the flag.

Resolution

The best resolution is to stop what is deleting the file (the external users deleting the file).  This may mean disabling the use of temp files in office, or storing other temp files or cookies to a local directory instead of a shared one.  If this cannot be done, then alter viruschecker.conf to exclude these types of files from being checked by altering the 'excl' line to exclude ~$*.* (for office files), *.tmp or any other extension that may be causing these errors.

viruschecker.conf:
CIFSserver=<CIFS server on data mover>
addr=<configured CAVA servers>
excl=~$*.*:*.accdb:*.laccdb:*.ldb:*.mdb:*.pst:*.tmp:????????
masks=*.*
shutdown=viruschecking

Additional Information

Additional resources:

https://wiki.wireshark.org/SMB2/SMB2_FILE_DISPOSITION_INFO  Third party link icon   (SMB2_FILE_DISPOSITION_INFO addresses 'delete on close') feature

Επηρεαζόμενα προϊόντα

VNX1 Series

Προϊόντα

Celerra, VNX1 Series, VNX2 Series
Ιδιότητες άρθρου
Article Number: 000052379
Article Type: Solution
Τελευταία τροποποίηση: 25 Μαΐ 2026
Version:  4
Βρείτε απαντήσεις στις ερωτήσεις σας από άλλους χρήστες της Dell
Υπηρεσίες υποστήριξης
Ελέγξτε αν η συσκευή σας καλύπτεται από τις Υπηρεσίες υποστήριξης.