cancel
Showing results for 
Search instead for 
Did you mean: 

Linux OAS 2 GB file problem

I'm seeing a problem with writing large files, when the file reaches 2 GB in size, the file becomes unreadable.

In the current isecoasmgr.log log file there will be an error like:

Jan 25 10:11:30 oldefortran ERROR AMOASScanner [3509] Engine error occurred for the File Name: /scratch/local/fortran/xx

After executing these commands, I am able to write then read files >= 2 GB with no problem.

/opt/isec/ens/esp/bin/isecespdControl.sh stop

/opt/isec/ens/threatprevention/bin/isectpdControl.sh stop

Should something be changed in the OAS profile?

4 Replies

Re: Linux OAS 2 GB file problem

I am seeing similar issue in our environment. What was the fix?

Reliable Contributor User91972758
Reliable Contributor
Report Inappropriate Content
Message 3 of 5

Re: Linux OAS 2 GB file problem

If a file you're scanning is giving an error with event id 1048 in the ePO threat event logs, general system error, it may be best to exclude the file being scanned at that time. Chances are likely that the scan will continue to error out either do to file size, or due to the file type.

If you have multiple large files, maybe test creating an exclusion for one or two, and see if this resolves the error you're receiving. Obviously this isn't the best fix because we're allowing something through, but it will take care of the error events we see in our logs.

Hope this is of some assistance!

Re: Linux OAS 2 GB file problem

I do see 1048 in event log. Does this error linked to Kernel Panic Attak as well?

Reliable Contributor User91972758
Reliable Contributor
Report Inappropriate Content
Message 5 of 5

Re: Linux OAS 2 GB file problem

It very well could be.

 

I've been working on trying to track down why some of my environment's SAS application servers are hanging / crashing during an On-Demand Scan. In the case of an On-Access scan I wouldn't rule it out. Depending on the amount of resources being used / the file that's being scanned I believe it could cause this problem.

 

I was unable to confirm with my Linux Support team if we had seen a kernel panic error on our systems, but that does sound like something we've encountered due to scanning. It seems that over utilization of system resources could cause this. Scanning a file that's a decent size can definitely cause problems.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator