SVM not dealing with scans and then froze

[nicksullivan]

We have seen the following error occurring 100's of times on one of our OSS servers, U.4944.6224: Nov 14 2019:13:34:10.359: ERROR: avs_server.c: 503: Failed to open file: \\?\X:\McAfee\MOVE AV Server\scanfiles\4840, err: 13 the outcome was the OSS server froze and all the clients accessing the OSS also froze. Should the SVM Manager not have identified this issue and redirected the clients to one of the other 11 OSS servers? If not, in what situation does a client get moved to a different OSS server?

[patrakshar · Accepted solution]

Hello @nicksullivan 

Thank  you for your post here. There are two part tho this post. Firstly why this error is coming. For this I would need to know the exact build version of MOVE and also need the MOVE Debug enabled log when issue got re-produced. Both 4.6 and 4.8 had similar entries but for completely different reason. This I can only verify by having the full build and the Logs.

Secondly regarding the SVA-Manger handling this situation. SVA-Manager will assign a new SVM/OSS to the clients only if current SVM/OSS is not reachable. Here network connection is absolutely in connected state between Client to existing OSS and to SVA-Manager. Hence SVA-Manager not getting a signal that current OSS needs to be replaced by a new one. Here OSS server is not able to access the files from RAM Drive causing the scan flood within the scanning network and resulting into OSS high CPU/Hung. 

Now thee could be multiple reason behind not able to read files from RAM Disk which needs to be looked at from the Debug enabled MER log and I can confirm. Please IM me the Debug enabled MER log. 

Follow the article https://kc.mcafee.com/corporate/index?page=content&id=KB87799 to enable the Debug in OSS.