Video Screencast Help

Symantec endpoint protectio error message

Created: 25 Jun 2013 | 13 comments

Hi,

 

I have a symantec endpoint protection installed on a computer running windows xp OS. Whenever i want to scan an external media or the whole computer, it says that there is no enough disk space.I have confirmed that there is free disk space of 130GB. I have uninstalled and installed but no change.

Let me have a solution to all this problem.

 

Regards.

Operating Systems:

Comments 13 CommentsJump to latest comment

Rafeeq's picture

whats the version of SEP you have installed?

the new veresion is 12.1.3 , have this downlaoded from fileconnect and install and scan.

check this discussion try changing the environment variables

https://www-secure.symantec.com/connect/forums/sep-cant-start-scanning-not-enough-disk-space#comment-3991051

crapando's picture

  Hi,

 The version is 12.1.2015.2015.Below is the error message.

 

   

AttachmentSize
Symantec antivirus error msg.pdf 135.95 KB
Rafeeq's picture

right click my computer icon

select properites

select advanced

click on Evironment variables.

what values do you see for TMP and temp ?

it should be %USERPROFILE%\AppData\Local\Temp

if its anyting diff, click on edit and correct it to %USERPROFILE%\AppData\Local\Temp

diLL's picture

I'm using Windows XP Professional SP3 Swedish

Default TMP/TEMP is:
%USERPROFILE%\Lokala inställningar\Temp

Tried to change both (TMP/TEMP) to %USERPROFILE%\AppData\Local\Temp but it still don't work...

Chetan Savade's picture

Hi,

Thank you for posting in Symantec community.

I would be glad to answer your question.

It seems to me operating system releated issue.

Check these articles

http://www.symantec.com/business/support/index?page=content&id=TECH153952

http://www.symantec.com/connect/forums/sep-not-enough-free-space-preform-scan

If couldn't help then run vpdebug tool on the affected machine.

How to enable "Vpdebug Logging" on Symantec Endpoint Protection 11.0, 12.1, and 12.1 RU1

http://www.symantec.com/docs/TECH102939 

Chetan Savade
Sr Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

diLL's picture

SEP Debug log when try to run a Active Scan;

13:45:11.410976[_592][_5620]|THRD: End thread Product Control::0 ID:0x000015F4
13:45:11.424195[_592][_2372]|WAITOBJHANDLER: Wait Object processed.  pIWaitableObj = 0x03056668 (Product Control::0) With event handle 0x00000FD4
13:45:11.424899[_592][_2372]|WAITOBJHANDLER: Setting up event list with 10 waitable objects and 0 threads in list
13:45:13.811590[_592][_1968]|AVUnremediatedJobWorker: Starting job AVUnremediatedRescanJob
13:45:13.832958[_592][_3688]|Running job: AVUnremediatedRescanJob
13:45:14.442504[_592][_3688]|UnremediatedItemWorker has nothing to scan.
13:45:17.910883[_592][_2996]|ScanManagerService checking scan status.
13:45:17.911185[_592][_2996]|CScanManagerService::IsScanRunning(). ScanID 0 scan is NOT Running.
13:45:17.914606[_592][_2528]|ScanManagerService starting scan.
13:45:17.914988[_592][_2528]|Trying to Start Scan.
13:45:17.920078[_592][_2528]|Token: opened for user(XxUserXx):session(0)
13:45:17.920783[_592][_2528]|Token Manager: Adding Tokens; Total token Count(0)
13:45:17.920923[_592][_2528]|Token: copied for user():session(0)
13:45:17.921064[_592][_2528]|Token: copied for user():session(0)
13:45:17.921225[_592][_2528]|Token: copied for user(XxUserXx):session(0)
13:45:17.921346[_592][_2528]|Token Manager: Added token for user(XxUserXx):session(0):key(1382407941)
13:45:17.922070[_592][_2528]|Starting Async Scan: RTV Scan 0x5265DF05.
13:45:17.922533[_592][_2528]|THRD: Thread RTV Scan 0x5265DF05 created 0x0000149C
13:45:17.922875[_592][_2528]|Scan Thread Group Started: 149C.
13:45:17.923016[_592][_2528]|Token: closed for user(XxUserXx):session(0)
13:45:17.923217[_592][_4560]|THRD: Start new thread RTV Scan 0x5265DF05 ID:0x000011D0
13:45:17.970942[_592][_4560]|The scan thread 0x00001620 locked the Async Scan Mutex.
13:45:17.973115[_592][_4560]|Not enough disk space for User Application Data files on Drive C:\Documents and Settings\XxUserXx\Lokala inställningar\Application Data\Symantec\Symantec Endpoint Protection\Logs\.
13:45:17.973397[_592][_4560]|Scan Failure: Not enough free disk space to perform a scan
13:45:21.084806[_592][_4560]|Added MAC Address to the event block: 00:24:21:8x:xX:xX
13:45:21.085229[_592][_4560]|Added Windows domain/workgroup to the event block: XxWorkgroupXx
13:45:21.085390[_592][_4560]|Added product to the event block: 12.1.3001.165
13:45:21.085591[_592][_4560]|Token: copied for user(XxUserXx):session(0)
13:45:21.085732[_592][_4560]|Token Manager: Getting token for user(XxUserXx):session(0):key(1382407941)
13:45:21.085893[_592][_4560]|Token: closed for user(XxUserXx):session(0)
13:45:21.087583[_592][_4560]|Token: copied for user(XxUserXx):session(0)
13:45:21.087885[_592][_4560]|Token Manager: Getting token for user(XxUserXx):session(0):key(1382407941)
13:45:21.088287[_592][_4560]|Token: closed for user(XxUserXx):session(0)
13:45:21.088569[_592][_4560]|Logging User APP Data to file C:\Documents and Settings\XxUserXx\Lokala inställningar\Application Data\Symantec\Symantec Endpoint Protection\Logs\10272013.Log
13:45:21.088871[_592][_4560]|WriteFileLogEntry: Failed to append\create the file C:\Documents and Settings\XxUserXx\Lokala inställningar\Application Data\Symantec\Symantec Endpoint Protection\Logs\10272013.Log.  Errno = 3.
13:45:21.089032[_592][_2372]|THRD: Thread Action Notify Event::0 created 0x00000830
13:45:21.089193[_592][_2372]|WAITOBJHANDLER: Spawned Waitable object seperate thread. pIWaitableObj = 0x013A3988 (Action Notify Event::0) as thread 0x00000830
13:45:21.090017[_592][_2372]|WAITOBJHANDLER: Setting up event list with 9 waitable objects and 1 threads in list
13:45:21.089213[_592][_4560]|Logging error 0x2000000A (536870922) writing to 'C:\Documents and Settings\XxUserXx\Lokala inställningar\Application Data\Symantec\Symantec Endpoint Protection\Logs\10272013.Log'
13:45:21.089494[_592][_4200]|THRD: Start new thread Action Notify Event::0 ID:0x00001068
13:45:21.146817[_592][_4200]|THRD: End thread Action Notify Event::0 ID:0x00001068
13:45:21.147179[_592][_2372]|WAITOBJHANDLER: Wait Object processed.  pIWaitableObj = 0x013A3988 (Action Notify Event::0) With event handle 0x00000C70
13:45:21.147400[_592][_2372]|WAITOBJHANDLER: Setting up event list with 10 waitable objects and 0 threads in list
13:45:21.146455[_592][_4560]|CleanupScanThread() for the scan 0x5265DF05.
13:45:21.207721[_592][_4560]|Releasing the Async Scan Mutex for Scan 0x5265DF05.
13:45:21.208385[_592][_4560]|RDWRLOCK (65f0f304): Reader wait for write lock.
13:45:21.208606[_592][_4560]|RDWRLOCK (65f0f304): Reader write lock.
13:45:21.208747[_592][_4560]|RDWRLOCK (65f0f304): Read lock (1).
13:45:21.208888[_592][_4560]|RDWRLOCK (65f0f304): Read release (0).
13:45:21.209029[_592][_4560]|RDWRLOCK (65f0f304): Reader write release.
13:45:21.209170[_592][_4560]|Token Manager: Removing On demand access tokens for Scan Id(1382407941), Current token count(1)
13:45:21.209310[_592][_4560]|Token Manager: Removing token for scan id(1382407941), Type(1), Session(0), for user(XxUserXx)
13:45:21.209451[_592][_4560]|Token: closed for user(XxUserXx):session(0)
13:45:21.209592[_592][_4560]|Token Manager: Total token Count(0), Tokens Removed(0)
13:45:21.209733[_592][_4560]|THRD: End thread RTV Scan 0x5265DF05 ID:0x000011D0
13:45:24.483690[_592][_1948]|AVUnremediatedJobWorker: Exit AVUnremediatedRescanJob
13:45:29.090078[_592][_2288]|CScheduledScanServiceNotify::InitRegNotification: registering handle 0x00001014 for notifications
13:45:29.108146[_592][_2288]|Scheduled Scan Service Notify: waiting for a complete scan configuration.
13:45:31.961224[_592][_2372]|THRD: Thread Product Control::0 created 0x00001E34
13:45:31.961526[_592][_2372]|WAITOBJHANDLER: Spawned Waitable object seperate thread. pIWaitableObj = 0x03056668 (Product Control::0) as thread 0x00001E34
13:45:31.962009[_592][_2372]|WAITOBJHANDLER: Setting up event list with 9 waitable objects and 1 threads in list
13:45:31.961164[_592][_1916]|Setting retry counts - Retries 3 nRetryRate 1
13:45:31.987723[_592][_1916]|Processing key: ProductControl
13:45:31.961788[_592][_5372]|THRD: Start new thread Product Control::0 ID:0x000014FC
13:45:32.023379[_592][_5372]|WhenRegChange Product Control:Sun Oct 27 12:45:35 2013
13:45:32.132029[_592][_5372]|Product Control change noted, re-reading.
13:45:32.132411[_592][_5372]|Entering threadproc: UpdateFromReg()
13:45:32.133397[_592][_5372]|UpdateFromReg
diLL's picture

Scan Failure: Not enough free disk space to perform a scan

Symantec Endpoint Protection 12.1 RU3
SEP 12.1.3001.165
Microsoft Windows XP SP3

Every time I try to make a scan (Active or Full) on all (>20) Self-managed clients running XPP when the computer has been running for >24h. A reboot make it works again (for some hours)...

technical_specialist's picture

Upgrade your sep client version and check your issue still persist or not

diLL's picture

How do I upgrade?! What I know the SEP 12.1 RU3 is today (2013-10-22) the latest release. There is no new version on Fileconnect? 

Chetan Savade's picture

Hi,

SEP 12.1 RU3 is the latest version & SEP 12.1 RU4 is due for release in next few days.

Chetan Savade
Sr Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

technical_specialist's picture

Run the CleanWipe tool on that system nad reinstall the SEP Client then check issue is still or not.

Fo cleanwipe you need to contact with Tech Support

Check these Steps below:

How to create a new case in MySymantec

http://www.symantec.com/business/support/index?page=content&id=TECH58873

Phone numbers to contact Tech Support:-

Regional Support Telephone Numbers:

  • United States: 800-342-0652 (407-357-7600 from outside the United States)
  • Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
  • United Kingdom: +44 (0) 870 606 6000

http://www.symantec.com/support/contact_techsupp_static.jsp

diLL's picture

CleanWipe did not solve my problem unfortunately...