The NetApp filer could possibly be protected by a VSE for Storage. If the NetApp filer is configured for " Mandatory Scans" if for any reason the requested file is not scanned you will not be able to retrieve it from the filer
that is what happend: users where not able to retrieve files. I have changed it to off.
But my question is: why was McAfeee unable to communicate with the filer ?
I tested the connection to NetApp Filer via ping, DNS resolultion etc. all looked okay. So I hoped the subcode -1073741635 could give me more information about the broken communication. Was it network connection at all, was it IP, was it TCP ?
I have no idea what went wrong. My only solution is to watch windows event log.
Thanks for your help
Your post does not include the actual event log entry, nor does it contain relevant data, such as that Virus Scan for Storage was even installed.
We do not know what version of VSE –Storage you are running the patch level or if you have any Hot Fixes applied. We also do not know the frequency of the issue or correlating events. We have no logs.
But if we are up for taking shots in the dark, I think you might need to put the FQDN for the scan servers in the host file on the filer to make sure you are always getting proper name resolution.
Also make sure the Scanner is configured to connect to the IP address of the filer
You should also be running a minimum of one more Scanner then Filers.
1 Filer= 2 Scanner
2 Filers = 3 Scanners
10 Filers = 11 Scanners
Relevant data can be found in the
1. Output of the VSCAN OPTIONS command from the filer. This should give me the timeout settings and the mandatory scan settings.
2. The rc file from the filer - etc/rc
3. The hosts file from the filer
4. The version of Data OnTap
5. Messages files from filer (note the time the error/issue occurred so it's easier to track down the error)
6. VSES_Log.txt -located in the product's directory
7. Stats_NetApp.log - located in the VSE-Stor install directory.
8. Start run %deflogdir% zip and provide the contents.
9. VSE MERS from the scanning server(s) seeing issue. If not related to scanner server, MER from any scanner server
10. Topology, i.e. network diagram in which filer(s) and scanner server(s) reside
also note in some cases a Network capture using Ehtereal/Wireshark, may be neccesary when connection failure occurs.
thank you for your reply. As stated I was really new to McAfee and you are absolutely right with the shot in the dark.
I was asked as a network admin if I could help to solve this situation.
VSCAN runs for many days and this event happens sporatically and because
vscan options mandatory_scan to| on users are not able to access their files.
After searching around in the mentioned logs I found this entry
EventID: 259 unable to connect to filer xyz: -1073741635
Because I have checked the connectivity, DNS resolutions, hosts etc. without any hints I hoped to get more information with -1073741635
I agree this was not really professional
In the meantime we changed
vscan options mandatory_scan to| off to prevent users are unable to access their files.
McAfee VirusScan Enterprise for Storage 1.0
on the filer
On W2K8R2 we disabled SMB2 because running ONTAP does only supports SMB1 as I have been told !!
So we will monitore the scenario and I will follow your informations where to look for. Thanks again harryr
McAfee-Problem.docx 243.1 K
Hi harryr, just wondering if you ever sorted this issue out ?
sorry having not marked as answered.
There are 2 Hotfixes available which solved it.
Please follow exactly the Support instructions in particular regarding NetApp cifs.rpcfd_timeout
Please find attached the HF539302 and HF685485. Please, make sure you test the HF in one machine before deploying the rest of the machines.
After apply the HF, please implement those steps:
1. Modify the following filer option: cifs.rpcfd_timeout to a value of 0. To change the value run the following: options cifs.rpcfd_timeout 0 <enter>
2. Confirm the option took by typing: options cifs.rpcfd_timeout <enter> , the value returned for the option should be 0
3. Do one of the following to ensure the malfunctioning AV servers disconnect and reconnect:
a. Cycle the McAfee AV services on the server itself
b. Disable / Re-enable AV on the filer
4. Monitor for the behavior to re-appear