EMC CAVA server reports "SCSCANFILE_FAIL_CONNECT" when connecting to Symantec Scan Engine under load

Article:TECH93003  |  Created: 2009-01-20  |  Updated: 2010-09-09  |  Article URL http://www.symantec.com/docs/TECH93003
Article Type
Technical Solution



Scan Engine or Symantec Antivirus for Network Attached Storage (SAV for NAS) is integrated with EMC Celerra server. You notice errors in the Virus Checker log which indicates that some files are not being scanned. Investigation reveals SCSCANFILE_FAIL_CONNECT error messages in the EMC control center or CAVA server log files.


  • In the Virus Checker logs of the Celerra server, entries similar to the following appear:
    VC: 3: 7: ' \' was not checked.
  • CAVA logs show that scans fail with an error similar to:
  • Some files are not scanned.
  • Each CAVA client scans close to 5 thousand files before the issue presents itself.



The operating system where CAVA and Scan Engine are installed is running out of TCP ports.


To set initial TCP stack settings within the Windows registry

  1. Open the Windows registry
  2. Navigate to \\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters
  3. If the DWORD value "MaxUserPort" does not exist, create it.
  4. Set "MaxUserPort" to a decimal value of 60000.
  5. If the DWORD value "TcpTimedWaitDelay" does not exist, create it.
  6. Set "TcpTimedWaitDelay" to a decimal value of 30.

A reboot of the server is required for these changes to take effect


Technical Information

About Window 2003 Server default TCP stack settings
By default, Windows 2003 Server does not have a DWORD registry entry for TcpTimedWaitDelay, which defaults to a value of 420 seconds. When a TCP connection becomes unresponsive, Windows will therefore wait 420 seconds before releasing the connection to use. Also by default, Windows 2003 Server does not have a DWORD registry entry for MaxUserPort, which defaults to 5000 available ports per user. In a high load environment, adjusting these values makes the server more responsive.

The TcpTimedWaitDelay specifies the time that must elapse before TCP can release a closed connection and reuse its resources. This interval between closure and release is known as the TIME_WAIT state or 2MSL state. During this time, the connection can be reopened at much less cost to the client and server than establishing a new connection. Reducing the value of this entry allows TCP to release closed connections faster, providing more resources for new connections.

The MaxUserPort determines the highest port number TCP can assign when an application requests an available user port from the system. By default, Microsoft Windows Server 2003 sets the MaxUserPort value to 5000.


Legacy ID


Article URL http://www.symantec.com/docs/TECH93003

Terms of use for this information are found in Legal Notices