6 Replies Latest reply on Feb 22, 2012 2:23 AM by harryr

    EventID: 259  unable to connect to filer xyz: -1073741635

      Hi all,

       

      I am new to McAfee  and would like to find out if the subcode  -1073741635  could help me to find out what was the reason for  beeing unable to connect to the NetApp Filer.  WINDOWS 2008 R2   VirusScan Enterprise + AntiSpyware 8.7.01

       

       

      This situation comes up sporately and leads to Access Denied Messages for the files on the NetApp Filer.

       

       

       

      Regards harryr

        • 1. Re: EventID: 259  unable to connect to filer xyz: -1073741635
          dmcgeary

          The NetApp filer could possibly be protected by a VSE for Storage. If the NetApp filer is configured for " Mandatory Scans" if for any reason the requested file is not scanned you will not be able to retrieve it from the filer

          • 2. Re: EventID: 259  unable to connect to filer xyz: -1073741635

            Hi DMCGEARY,

             

            that is what happend:  users where not able to retrieve files.  I have changed it to off.
            But my question is:  why was McAfeee unable to communicate with the filer ?

            I tested  the connection to NetApp Filer  via ping,  DNS resolultion  etc. all looked okay.  So I  hoped the subcode -1073741635  could give me more information about the broken communication.  Was it  network connection at all, was it IP, was it  TCP ?

             

            I have no idea what went wrong.  My only solution is to watch windows event log.

             

             

            Thanks for your help

             

            harryr

            • 3. Re: EventID: 259  unable to connect to filer xyz: -1073741635
              dmcgeary

              Your post does not include the actual event log entry, nor does it contain relevant data, such as that Virus Scan for Storage was even installed.

              We do not know what version of VSE –Storage you are running the patch level or if you have any Hot Fixes applied. We also do not know the frequency of the issue or correlating events. We have no logs.

              But if we are up for taking shots in the dark, I think you might need to put the FQDN for the scan servers in the host file on the filer to make sure you are always getting proper name resolution.

              Also make sure the Scanner is configured to connect to the IP address of the filer

               

              You should also be running a minimum of one more Scanner then Filers.

              1 Filer= 2 Scanner

              2 Filers = 3 Scanners

              10 Filers = 11 Scanners

               

              Relevant data can be found in the

              1. Output of the VSCAN OPTIONS command from the filer. This should give me the timeout settings and the mandatory scan settings.

              2. The rc file from the filer - etc/rc

              3. The hosts file from the filer

              4. The version of Data OnTap

              5. Messages files from filer (note the time the error/issue occurred so it's easier to track down the error)

              6. VSES_Log.txt -located in the product's directory

              7. Stats_NetApp.log - located in the VSE-Stor install directory.

              8. Start run %deflogdir% zip and provide the contents.

              9. VSE MERS from the scanning server(s) seeing issue. If not related to scanner server, MER from any scanner server

              10. Topology, i.e. network diagram in which filer(s) and scanner server(s) reside

              also note in some cases a Network capture using Ehtereal/Wireshark, may be neccesary when connection failure occurs.

              • 4. Re: EventID: 259  unable to connect to filer xyz: -1073741635

                Hi DMCGEARY,

                 

                thank you for your reply. As stated I  was really new to McAfee and you are absolutely right with the shot in the dark.
                I was asked as a network admin if I could help to solve this situation.

                 

                VSCAN runs for many days and this event happens sporatically  and because

                vscan options mandatory_scan to| on  users are not able to access their files.

                 

                 

                After searching around in the mentioned logs I found this entry
                EventID: 259  unable to connect to filer xyz: -1073741635

                 

                Because I have checked the connectivity, DNS resolutions, hosts  etc. without any hints I hoped to get more information with  -1073741635

                 

                I  agree this was not really professional

                 

                In the meantime we changed

                vscan options mandatory_scan to| off    to prevent users are unable to access their files.

                McAfee VirusScan Enterprise for Storage 1.0

                on the filer

                timeout 10

                 

                 

                abort_timeout 50

                On W2K8R2 we disabled SMB2 because running ONTAP does only supports SMB1 as I have been told !!

                So we will monitore the scenario and I will follow your informations where to look for.   Thanks again  harryr

                • 5. Re: EventID: 259  unable to connect to filer xyz: -1073741635

                  Hi harryr, just wondering if you ever sorted this issue out ?

                  • 6. Re: EventID: 259  unable to connect to filer xyz: -1073741635

                    Hi Peter,

                     

                    sorry  having not marked as answered.

                     

                    There are 2 Hotfixes available which solved it.

                     

                    Please  follow  exactly the  Support instructions  in particular  regarding  NetApp  cifs.rpcfd_timeout

                     

                    ==========================================================================

                    Please find attached the HF539302 and HF685485. Please, make sure you test the HF in one machine before deploying the rest of the machines.

                    ftp://custftp3.nai.com/outgoing/3-1804934575/VSES10HF539302.zip
                    ftp://custftp3.nai.com/outgoing/3-1804934575/VSES100HF685485.zip

                    After apply the HF, please implement those steps:

                    1. Modify the following filer option: cifs.rpcfd_timeout to a value of 0. To change the value run the following: options cifs.rpcfd_timeout 0 <enter>

                    2. Confirm the option took by typing: options cifs.rpcfd_timeout <enter> , the value returned for the option should be 0

                    3. Do one of the following to ensure the malfunctioning AV servers disconnect and reconnect:

                         a. Cycle the McAfee AV services on the server itself
                         b. Disable / Re-enable AV on the filer

                    4.   Monitor for the behavior to re-appear

                     

                    ===============================================================================


                    Harry