On enabling URL Filtering Symantec Protection Engine (SPE) 7.0 service (symcscan) stops and will not start on Windows

Article:TECH199744  |  Created: 2012-11-14  |  Updated: 2012-11-18  |  Article URL http://www.symantec.com/docs/TECH199744
Article Type
Technical Solution


Issue



You installed Symantec Protection Engine (SPE) 7.0 on Windows Server.

When you enable URL Filtering at the time of the installation or enable it from the Web console page, Service "Symantec Protection Engine" stops and will not get started.


Error



Application Event log

Log name:         Application
Source:           Application Error
Event ID:       1000
Task Category:      (100)
Level:           Error
Keywords:         Classic
Description:
Faulting application name: symcscan.exe, version: 7.0.0.46, time stamp: 0x50123cc8
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdb3b
Exception code: 0xc0000005
Fault offset: 0x00038c39
Faulting process id: 0x440
Faulting application start time: 0x01cdc2208e12c212
Faulting application path: C:\Program Files (x86)\Symantec\Scan Engine\symcscan.exe
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: 40dc4a03-2e16-11e2-bca7-000c29610e13
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-11-14T04:46:29.000000000Z" />
    <EventRecordID>209</EventRecordID>
    <Channel>Application</Channel>
    <Computer>win2008Svr</Computer>
    <Security />
  </System>
  <EventData>
    <Data>symcscan.exe</Data>
    <Data>7.0.0.46</Data>
    <Data>50123cc8</Data>
    <Data>ntdll.dll</Data>
    <Data>6.1.7600.16385</Data>
    <Data>4a5bdb3b</Data>
    <Data>c0000005</Data>
    <Data>00038c39</Data>
    <Data>440</Data>
    <Data>01cdc2208e12c212</Data>
    <Data>C:\Program Files (x86)\Symantec\Scan Engine\symcscan.exe</Data>
    <Data>C:\Windows\SysWOW64\ntdll.dll</Data>
    <Data>40dc4a03-2e16-11e2-bca7-000c29610e13</Data>
  </EventData>
</Event>

System Event log

Log name:         System
Source:           Service Control Manager
Event ID:       7011
Level:           Error
Keywords:         Classic
Description:
Timeout (30000 milliseconds) waiting for a transaction response from the symcscan service.
Event XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7011</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2012-11-14T04:50:58.350981000Z" />
    <EventRecordID>811</EventRecordID>
    <Correlation />
    <Execution ProcessID="448" ThreadID="2492" />
    <Channel>System</Channel>
    <Computer>win</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">30000</Data>
    <Data Name="param2">symcscan</Data>
  </EventData>
</Event>
 


Environment



  • Windows
  • Symantec Protection Engine (SPE) 7.0

Cause



URL Filtering engine fails to initialize itself because SSE does not have enough memory to load URL definitions. Please also see the SPE7.0 System requirements


Solution



How to identify the issue:

  1. Conform that Application Event Log and System Event log have similar erorrs described in the ERROR section above.
  2. On Windows Server on which you see the issue, add the follwing Sytem Environment varilables to your system to produce debug logs. To add environment variables, click Start and type "env" in the Search programs and files textbox, select Edit environment variables and click New in System environment varilables. You can change the file path to anywhere you like. In the following examle, the root directory of C drive is assumed. After you added the following pair of variable names and values, hit OK and close the window.

    URLSCANAPI_DEBUG_LEVEL=5
    URLSCANAPI_DEBUG_LOG=C:\url_log_all.txt
    URLSCANAPI_DEBUG_SECTION=63
    CSAPI_DEBUG_LEVEL=5
    CSAPI_DEBUG_LOG=C:\csapi-debug.log
    CSAPI_DEBUG_SECTION=32767
     
  3. Click Start and type "cmd" in Search Program and files textbox and hit Enter. On the command prompt, type the following and try to start symcscan service.

    > net start "Symantec Protection Engine"
     
  4. Starting symcscan service will fail if what you oberve is the behavior discribed in this document.
  5. As described in step 2, open the Environment varilables diaglogbox again and delete all the added environmenta variables with Delete.
  6. url_log_all.txt shows the following or similar entries:

    "Unable to create the instance"
    "creating module interface failed. Failure indicates due to bad RS defs. Trying Rollback"
     

How to tune the memory for URL Filtering

Reduce the jvm memory and more memory will be available for SSE process to load URL definitions.

  1. Uninstall SPE which is causing the problem.
  2. Reinstall SPE without URL Filtering enabled.
  3. After installation, place a file "ssejvm.config" in the install location (by default C:\Program Files\Symantec\Scan Engine\ or C:\Program Files (x86)\Symantec\Scan Engine\).
    ssejvm.config is used to control the Java Virtual Machine initialization values.
  4. Make sure ssejvm.config has the read/write permisson.
  5. Enter the following parameters in ssejvm.config (with leading hyphens):

    -Djava.library.path=.
    -Djava.net.preferIPv4Stack=true
    -Xms128M
    -Xmx256M
    -Xrs
     
  6. Restart the Symantec Protection Engine service to reflect the changes. Symantec Protection Engine should now be able to update the URL definitions successfully.

Note:
The Minimum JVM memory (Xms) may be set to any value between 32MB to 256MB, while the Maximum JVM memory (Xmx) should NOT exceed 256MB. If the Xmx value is set above 256MB, the issue of the URL definitions not getting updated may reoccur.
 


Supplemental Materials

SourceETrack
Value2995685



Article URL http://www.symantec.com/docs/TECH199744


Terms of use for this information are found in Legal Notices