4 Replies Latest reply on Apr 17, 2012 12:50 AM by jeggoc

    C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe took longer than 90000 ms to complete a request

      Everytime CAVA passes McAfee an exe or dll file, the below is logged in the Windows Event Logs:

      A thread in process C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe took longer than 90000 ms to complete a request.

      The process will be terminated. Thread id : 2200 (0x898)

      Thread address : 0x000000007736247A

      Thread message :

       

      Build VSCORE.14.4.0.354 / 5400.1158

      Object being scanned = \Device\Mup\saovs004\CHECK$\root_vdm_2\cifs_group_sao_r5_01\SAO-GROUP01\root\us er\depto\OSP\00_LA\Genexus\GABRIE~1\PORTAL~1\DATA002\web\bin\hindex2.dll

      by C:\Program Files\EMC\CAVA\CAVA.exe

      4(0)(0)

      4(0)(0)

      7200(0)(0)

      7595(0)(0)

      7005(0)(0)

      7004(0)(0)

      5006(0)(0)

      5004(0)(0)

       

       

      Any idea exactly what is going on? I we run the McShield service as the CAVA user it seems to clear up, but we do not think this configuration is supported by McAfee. Should we even be scanning dll's or exex' server side? Should this be left to desktop AV software?

        • 1. Re: C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe took longer than 90000 ms to complete a request
          sbenedix

          Please contact EMC, they have developed the agent, its proprietary. From KB51111 (lists supported environment for VSE):

           

          Support for third-party applications

                                                                                                                                                  

          ApplicationVSE 8.8VSE 8.7iComments
          EMC Celerra Network Server
                      EMC Celerra Antivirus Agent (CAVA)
          Note1Note1CAVA is an agent running on a Windows server that communicates with a 3rd party antivirus engine to scan files stored on a Celerra Network Server.

           

           

          1 Contact EMC for identifying what versions their CAVA supports.

           

          McAfee supports EMC Isilion, these devices employ an ICAP client which can be integrated with the VSE storage module. (KB74863) Setting the McShield Service to run in any other context than "local system" introduces considerable risk for the host and is not recommended nor supported.

          • 2. Re: C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe took longer than 90000 ms to complete a request

            Yes, but is running the McShield service as the CAVA user i.e. an admin/domain admin user a support configuration? That is not within EMC's remit to answer

             

            Also, the McShield service is taking too long to respond, not CAVA

            • 3. Re: C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe took longer than 90000 ms to complete a request
              wwarren

              jeggoc wrote:

               

              Yes, but is running the McShield service as the CAVA user i.e. an admin/domain admin user a support configuration? That is not within EMC's remit to answer

               

              Also, the McShield service is taking too long to respond, not CAVA


              McShield service (OAS) must remain a SYSTEM service. Running it as a User account can lead to files being unscanned.

               

              The error you pasted indicates a "fatal" timeout. This behavior is intentional on our part as a necessary means to avoid potentially locking up the file system.

              For every scanning thread our OAS uses for scanning, there is a companion "monitoring" thread which is seeing how long the scan is taking.

              If the monitoring thread hits the configured Timeout values, it advises the scanning thread to stop scanning the file it's working on.

              The monitoring thread continues to see how long the scanning thread takes to respond to the "abandon scan" request. And if it reaches the configured Timeout value a second time, it tells McShield to self-terminate, assuming that the scanning thread has locked up and is unresponsive.

               

              Timeouts usually occur on specific files and are one-off events.

              When you get a scenario of timeouts occurring repeatedly, and consistently, even on small files, it points to a compatibility problem. Most likely, there is another application installed that has a file-system filter driver, and it's blocking (not denying) McShield's access to the file - thus it can't read the file to scan it, and yet the monitoring thread is counting away... waiting for the inevitable "fatal" Timeout.

               

              When Timeouts are not consistent, but common enough to be of concern, you could have environmental factors causing us issues.

              e.g. Heavy network latency for remote scanning operations (such as in a CAVA environment) will lead to the monitoring thread reaching it's Timeout settings prior to the scanning thread finishing the scan.

              1 of 1 people found this helpful