Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.


Created: 27 Apr 2012 | 8 comments

Scan engine version 5.2.8

We are calling the scan engine through an api call in c#

We are experiencing intermittent exceptions on the same file when scanning.  At the same time we are scanning 100+ files but this one file ittermittently gets the exception shown in the title.  The file size is around 120k which is larger than some files but smaller than others being scanned.

We are using streaming and here is a code snippet of what we are doing.  The error occurs on the Finish() call.  Any help is much appreciated.  I have access to the xml config values so I can answer any questions about the values in them.

var manager = new ScanRequestManager();

var engines = new List<ScanEngineInfo>{

new ScanEngineInfo(


Properties.Settings.Default.ScanEnginePort) };

manager.PrepareForScan(engines, int.MaxValue, int.MaxValue);

var scan = manager.CreateStreamScanRequest(Policy.SCAN);

scan.Start(string.Empty, string.Empty);

...Bunch of business logic filling an 8k buffer


...More business code

var result = scan.Finish(outputStream);

Comments 8 CommentsJump to latest comment

TSE-JDavis's picture

Sounds like you need to incorporate better error handling into your code.

What do you see in the Scan Engine logs when you run a detailed report? Scan Engine should log the issue it had with the file.

I am wondering why you are scanning the same file more than once.

B_Smith's picture

So, you are saying that the intermittent scan errors are acceptable and should be handled and retried in code?

The reason we are scanning the same file over and over again is to troubleshoot the issue.  It is not normal practice if the scan engine is working properly.

The scan logs didnt show a thing.  We turned on verbose logging and nothing was shown that we could see.  Is there another log to look at that will show the error?  The ones we looked at in the /log directory only showed information on files that were scanned.  Nothing in there about errors.

TSE-JDavis's picture

We will not be able to scan every file, that is true.

Perhaps you can perform a packet capture during the exchange so you can see exactly where the ICAP conversation breaks down.

B_Smith's picture

I understand the scan engine will not be able to scan every file and we handle those exceptions.  I dont understand how we scan 100+ files in a directory and only 1 file has intermittent issues.  The scan engine is running local so we should not be having any network issues and the file is just like the other files in that directory.  It is a .txt file.

We are going to upgrade to the latest version to see if that helps.

TSE-JDavis's picture

What is the result if you scan this file with the ssecls?

I was not suggesting that there are any network issues, but a packet capture would allow you to see the full ICAP conversation.

B_Smith's picture

I ran it multiple times and could not get it to fail using ssecls

Virus scan process began : Tue May 01 09:55:40 2012
Virus scan process completed : Tue May 01 09:55:40 2012

        Defs Version = 20120430.002
 Commandline Scanner =

         Total Bytes = 122865 (Kbytes 119.9854)
             Elapsed = 0.0310
           Scan Rate =  3.78 (Mbytes/sec)

      Files Excluded = 0
       Files Scanned = 1
 Directories Scanned = 0
Directories Excluded = 0
       Files Skipped = 0
    Files Scan Error = 0
      Files Infected = 0

No error was found during the scan

TSE-JDavis's picture

The ssecls is our testing tool. There may need to be some more debugging done on your code to determine what the exception was and how to handle it more gracefully.

B_Smith's picture

Digging a little deeper we found this exception.

System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host.