cancel
Showing results for 
Search instead for 
Did you mean: 
jmazzeo07
Level 9

Rule Engine Error - (14002) Internal antivirus filter error.

Hi all, I'm having this error in one MWG of a customer. I have checked the space on /opt partition and it have 90% free (somebody solved a similiar issue freeing space there).

On the mwg-antimalware.errors.log I see this lines repeteadly:

LOG FLOOD - START    ] 6 times within the last 763ms [4D35D9AC14C6DA28][>>> [Anti-Malware Engine] [BackCallTimeout] Backcall with ID '809' failed due to timeout. <<<]

[2016-03-14 21:40:31.673 +07:00] [ ERRORS LOG FLOOD - RELEASED ] 3 times within the last 269ms [4D35D9AC14C6DA28][>>> [Anti-Malware Engine] [BackCallTimeout] Backcall with ID '809' failed due to timeout. <<<]

[2016-03-14 21:40:31.673 +07:00] [Anti-Malware Engine] [BackCallTimeout] Backcall with ID '809' failed due to timeout.

[2016-03-14 21:40:37.809 +07:00] [Anti-Malware Engine] [BackCallTimeout] Backcall with ID '809' failed due to timeout.

[2016-03-14 21:40:38.094 +07:00] [Anti-Malware Engine] [BackCallTimeout] Backcall with ID '809' failed due to timeout.

[2016-03-14 21:40:47.578 +07:00] [Anti-Malware Engine] [BackCallTimeout] Backcall with ID '809' failed due to timeout.

[2016-03-14 21:40:47.657 +07:00] [Anti-Malware Engine] [BackCallTimeout] Backcall with ID '809' failed due to timeout.

This is the error on the users screen:

Rule Engine Error 

An internal error occurred while processing your request. 

URL: http://www.google.com.ar/?gfe_rd=cr&ei=6snmVpbhBqWW8Qf05JCQCg

URL Categories: Search Engines

Current Rule ID: 6561

Current Rule Name: Block If Virus was Found

Error Message: (14002) Internal antivirus filter error.

There is a error log (one of a lot) on mwg-core.log file:

[2016-03-14 22:04:03.201 +07:00] [AV] [AVError] Error in AntivirusFilter: 'Call to external Anti-Malware engine provided error: kExFuResError (http://pki.google.com/GIAG2.crl)'.

As you can see, the web is just Google, no strange address or file to download. It happens with random web addresses and in random time of the day. They have restarted the appliance yesterday and the issue is still happening today.


Thanks for your comments and sorry my english.



0 Kudos
4 Replies
exbrit
Level 21

Re: Rule Engine Error - (14002) Internal antivirus filter error.

Moved to MWG for better handling

---

Peter

Moderator

0 Kudos
traktorista
Level 7

Re: Rule Engine Error - (14002) Internal antivirus filter error.

Hi, I have the same problem as jmazzeo07. What do you mean by: Moved to MWG for better handling?

0 Kudos
frank_enser
Level 12

Re: Rule Engine Error - (14002) Internal antivirus filter error.

Hi,

well as the error states, this looks like an internal engine error with scanning the certificate file. You should open an SR with McAfee, and additionally you can temporarily whitelist the URL for antivirus scan bypass.

Regards,

Frank

0 Kudos
Troja
Level 14

Re: Rule Engine Error - (14002) Internal antivirus filter error.

Hi ,

does this occur when scanning FTP traffic. There is a known issue at the Moment when scanning FTP traffic and GAM is configured to scan "unwanted programs".

Try to disable scanning of unwanted programs.

Cheers

0 Kudos