cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

ODS Engine failed to stop scanning of file <filepath> after timeout, now trying to cancel thread

Using ePO (5.9.1) managed ENSLTP (10.5.1) and we're having on-demand scans intermittently fail to complete. With debug logging turned on, one of the messages observed in the odsreport/full scan.log is "DEBUG AMODSScanner [8635] Engine failed to stop scanning of file <filepath> after timeout, now trying to cancel thread."

The thread never seems to cancel and the ODS doesn't complete. What is the remedy?

5 Replies
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: ODS Engine failed to stop scanning of file <filepath> after timeout, now trying to cancel

@Randy_Bell1 How are you initiating your ODS? Are you doing a Run Client Task Now, or are these scheduled tasks? 

If you are using a Run Client Task Now, I would highly advise that you do not use this, and instead switch to a scheduled task.  ODS tasks timing out via Run Client Task Now is expected behavior as it does have a default timeout period of 20 min. The type of Client Task assignment that you will want for your purposes is to take the ODS Scan Task that you want to run, assign it to the system of issue with a schedule for "Run Immediately". Then, once assigned, you can send a McAfee Agent wake-up call to the endpoint to have the scan invoke right away. You should then see the task runs completely instead of timing out.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Re: ODS Engine failed to stop scanning of file <filepath> after timeout, now trying to cancel

Thanks for the reply.

I'm aware of the default 20 min total timeout and override it in the options tab ("Stop Task on the Client After" field) for the Run Task Now when necessary, but this type of failure occurs before 20 minutes has elapsed.

Re: ODS Engine failed to stop scanning of file <filepath> after timeout, now trying to cancel

BTW, we do have scheduled (weekly) ODS and have seen 80 - 90% of the endpoints successfully complete, but it seems somewhat randomly various endpoints (not the same ones each time) fail to complete their scans. We want to get to 100% success.
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 5 of 6

Re: ODS Engine failed to stop scanning of file <filepath> after timeout, now trying to cancel

@Randy_Bell1 For the timeout message, if it is from the debug log, and not cessation of the entire scan, then it is possible that there is a particular file of the scan that has timed out, and it's not the entire scan timing out. (I'm only able to conject without seeing the message in full context of the logs and your configuration) Are you seeing a message of "scan terminated/cancelled" and activity stopping, or just that a thread is released/cancelled out of the many running during the scan?

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Re: ODS Engine failed to stop scanning of file <filepath> after timeout, now trying to cancel

Great questions. The (overall) ODS reports failure within a minute or so of starting typically. We often see several log statements indicating that specific file scans time out successfully, but in this case from the text of the log message it seems the per-file scan timeout occurs but the thread cannot stop the file scan (ie to release the thread and go on to scan another file). We don't see a log message about terminating the thread or terminating/cancelling the scan. In fact, we see a couple instances of the debug log statement I included in the first post at the very end of the full scan.log (ie nothing follows). To date, our only "work-around" has been to restart the threatprevention service, after which a full ODS often works.
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community