Frequent Decomposer 17 Errors when scanning files on a share with Scan Engine (SSE), SAV for NAS (SAV for NAS), and / or Protection Engine (SPE)

Article:TECH204412  |  Created: 2013-03-27  |  Updated: 2013-04-07  |  Article URL http://www.symantec.com/docs/TECH204412
Article Type
Technical Solution


Issue



You installed either Symantec Scan Engine (hereafter SSE) 5.x or Symantec Protection Engine (SPE) 7.x to scan files in a share on a NAS device. You notice that SSE / SPE reports frequent scan errors with "Scanner = Decomposer Result ID = 17." You would like to know why.


Error



The Scan Engine has encountered a scan error Date/time of event = xxxx-xx-xx xx:xx:xx Event Severity Level = Error Scanner = Decomposer Result ID = 17 File name = <path to the file> Client IP = <ip address> Scan Duration (sec) = 0.016 Connect Duration (sec) = 0.016 Scan Engine IP address = <ip address> Scan Engine Port number = 1344 Uptime (in seconds) = 12345678","Default","","",""


Environment



  • Symantec Scan Engine 5.2.x working with a NAS connector
  • Symantec Protection Engine 7.0.x working with a NAS connector

Cause



Decomposer Result ID = 17 means that the file cannot be opened for scan. 

SSE / SPE fails in opening a file for a variety of reasons. If the file is on a share, by its nature SSE / SPE more often encounters Decomposer 17 errors, as the chances for such a file being used / locked by other processes at the time of scan request are far greater than a standalone deployment.

For example, if the target file is simultaneously editable by more than two users at at time (such as a shared Excel file), or the file being downloaded at the time of scan request, SSE's / SPE's file open request for the share fails due to the file lock, resulting in a Decomposer 17 error.

The following figure shows the sample flow when more than two users edit the same file triggers a Decompser 17 error.

Figure 1. How the Decomposer Erorr 17 is triggered when more than two are editing a file


Solution



Check the memory usage for the SSE / SPE installed system at the time of the errors. If the Dec 17 errors unanimously occur for almost all of the files being scanned in a specific time frame and the system shows constantly high memory usage, SSE / SPE most likly cannot allocate the necessary memory for processing these files. Restart the system and see if the Dec 17 error persists.

If you do not see any high memory usage at the time of error and / or you see these Dec 17 errors only sporadically, then scan the sample with the handy scan client tool %SYMCscan ROOT%CmdLineScanner/ssecls.exe.

Execute the tool on the command prompt and scan the locally-copied sample which triggered Dec 17 error. If you do not see any Decomposer 17 error but see the scan result returned instead, the error is not triggered by the sample but by the timing of the file's status. Mos likely, at the time of scan request, the file was not ready for scan due to the reasons mentioned above (file being locked).





Article URL http://www.symantec.com/docs/TECH204412


Terms of use for this information are found in Legal Notices