Need assistance with CAVA setup on VNX7500

Sounds like quite a pickle!  First, grab the VNX Event Enabler document, just to check for any changes between the older documentation and the current.  I can't think of anything off the top of my head, but it's always a good start.

Second, be sure to download the latest VEE software from EMC, as VNX Event Enabler now replaces the older CAVA agent.  You'll note that VEE comes in 32-bit and 64-bit flavors - install the version that matches your server (64-bit), assuming you're using the 64-bit version of McAfee.

Next, be sure to install the VEE client and reboot the CAVA servers before attempting to start the CAVA service on the datamovers.  I've seen plenty of issues that were solved with a simple reboot.  Normally, when I do a VEE deployment, I will install the VEE software and ignore the option to reboot (select 'reboot later') - I will add the domain account to the CAVA service first, then reboot, so that the Windows server boots up with the service credentials set.  This is import, as you can go and look in the Windows Event Log and look at the service startup message.  If the CAVA service fails to start, look at the error.  Does it show the account is unable to log into the domain?  80% of the time, that's the problem and you'll have to troubleshoot the password, domain login rights or credentials on the local server.

Once you have the MMC snap-in installed, you can do all of the domain accuont work from the snap-in - this also ensures that you have the right privileges (AV rights) set on the account.  19% of the time, that's the problem.

If both of these fail, you're in that 1% category where it's something simple (password, network connectivity).

Let us know if this helps!

Karl

Karl,

Thanks for the assistance. I have restarted the EMC CAVA service on my Windows Servers under the Windows domain service account – service_cava. It looks like the service is starting.

I am having trouble installing the Data Mover Mgmt snap-in on my W7 64bit machine to add the virus check rights, however. I am not seeing a DataMover snap-in like there used to be to be able to add rights on CIFS DM for CAVA services.

See events in the attached file.

Pat Winton

Hey Karl,

I’m getting closer. The cava service on the Windows servers is getting three 155 events but is eventually starting.

However, when I start the client on the control station, it cannot see the Windows servers and shuts down. See attached logs and putty screens.

# server_setup server_2 -Protocol viruschk -option start

server_2 : done

# server_viruschk server_2

server_2 :

10 threads started.

3 Checker IP Address(es):

165.107.16.223 OFFLINE at Wed Dec 31 16:00:00 19 69 (GMT-08:00)

Unknown RPC version, CAVA version : ?, ntStatus: SUCCESS

AV Engine:

Server Name: legmsxrpt01.calegis. net

No signature date

165.107.16.227 OFFLINE at Wed Dec 31 16:00:00 19 69 (GMT-08:00)

Unknown RPC version, CAVA version : ?, ntStatus: SUCCESS

AV Engine:

Server Name: legcava03.calegis.ne t

No signature date

165.107.16.217 OFFLINE at Wed Dec 31 16:00:00 19 69 (GMT-08:00)

Unknown RPC version, CAVA version : ?, ntStatus: SUCCESS

AV Engine:

Server Name: legcava02.calegis.ne t

No signature date

1 File Mask(s):

.

5 Excluded File(s):

*.PST PAGEFILE.SYS *.TMP *.LDB *.MDB

Share
legcavadm02\CHECK$.

RPC request timeout=25000 milliseconds.

RPC retry timeout=5000 milliseconds.

High water mark=200.

Low water mark=50.

Scan all virus checkers every 10 seconds.

When all virus checkers are offline:

Shutdown Virus Checking.

Scan on read disable.

Panic handler registered for 65 chunks.

MS-RPC User: LEGCAVADM02$

MS-RPC ClientName: legcavadm02.CALEGIS.NET

# server_viruschk server_2 -audit

server_2 :

Total Requests: 0.

Requests in progress: 0.

NO ANSWER from the Virus Checker Servers: 0.

ERROR_SETUP: 0.

FAIL: 0.

TIMEOUT: 0.

0 files in the collector queue.

0 files processed by the AV threads.

Looks like progress!

You mentioned your OS is 64-bit - what version of McAfee are you running on your servers?  32-bit or 64-bit?

Try this:  in your viruschecker.conf, set "shutdown=no" and try to restart.  This will cause the CAVA service to keep trying to restart, but should give you more logs on the CAVA servers and more logs on the datamover.  Take a look at the server_log messages and see if you're getting more useful errors there.

Hi Karl,

I am getting closer. Here is latest output for virus checker on 1st VNX storage box…

# server_viruschk server_2

server_2 :

10 threads started.

3 Checker IP Address(es):

165.107.16.233 AV_NOT_FOUND at Wed Jan 2 15:28:43 2013 (GMT-08:00)

MS-RPC over SMB, CAVA version: 5.0.6.1, ntStatus: SUCCESS

AV Engine: Unknown third party antivirus software

Server Name: legcava04.calegis.net

Last time signature updated: Sun Dec 30 22:37:20 2012 (GMT-08:00)

165.107.16.227 ONLINE at Wed Jan 2 15:28:43 2013 (GMT-08:00)

MS-RPC over SMB, CAVA version: 5.0.6.1, ntStatus: SUCCESS

AV Engine: Network Associates

Server Name: legcava03.calegis.net

Last time signature updated: Mon Dec 31 23:15:21 2012 (GMT-08:00)

165.107.16.217 ONLINE at Wed Jan 2 15:28:43 2013 (GMT-08:00)

MS-RPC over SMB, CAVA version: 5.0.6.1, ntStatus: SUCCESS

AV Engine: Network Associates

Server Name: legcava02.calegis.net

Last time signature updated: Mon Dec 31 14:32:55 2012 (GMT-08:00)

221 File Mask(s):

*.386 *.ACE *.ACM *.ACV *.ACX *.ADD *.ADE *.ADP *.ADT *.APP *.ASD *ASP *.ASX

*.AVB *.AX *.BAS *.BAT *.BIN *.BO? *.BTM *CBT *.CDR *.CER *.CFM *.CHM *.CLA

*.CLASS *.CMD *.CNV *.COM *.CPL *.CPY *.CRT *.CSC *.CSH *.CSS *.DAT *.DBX

*.DER *.DEV .DL? *.DLL *.DO? *.DO?? *.DOC *.DOCX *.DOT *.DRV *.DVB *.DWG

*.EML *.EXE *.FON *.FXP *.GADGET *GMS *.GVB *.HLP *.HTA *.HTM *.HTML *.HTT

*.HTW *.HTX *.IM? *.INF *.INI *.INS *.INS *.ISP *.ITS *.JS *.JS$ *.JSE *.JTD

*.LGP *.LIB *.LNK *.MAD *.MAF *.MAG *.MAM *.MAQ *.MAR *.MAS *.MAT *.MAU *.MAV

*.MAW *.MB? *.MDA *.MDE *MDT *.MDW *.MDZ *.MHT *.MHTM *.MHTML *.MOD *.MP?

*.MPD *.MPP *.MPT *.MRC *.MS? *.MSC *.MSG *.MSG *.MSH *.MSHL *.KSH *.MSHLXML

*.MSH2 .MSH2XML *.MSHXML *.MSI *.MSO *.MSP *.MST *.NCH *.NWS *.OBD *.OBJ

*.OBZ *.OCX *.OFT *.OLB *.OLE *OPS *.OTM *OV? *.PCD *.PCI *.PDB *.PDF *.PDR

*.PHP *.PIF *.PL *.PLG *.PM *.PNF *.PNP *.POT *.PP? *.PP?? *.PPA *.PPS *.PPT

*.PRC *.PRF *.PRG *.PS1 *.PS1XML *.PS2 *.PS2XML *.PSC2 *.PWZ *.QLB *.QPW

*.REG *.RTF *.SBF *.SCF *.SCO *.SCR *.SCT *.SH *.SHB *.SHS *.SHT *.SHTML

*.SHW *.SIS *.SMM *.SWF *.SYS *.TD0 *.TLB *.TSK *.TSP *.TT6 *.URL *.VB *.VB?

*.VBA *.VBE *.VBS *.VBX *.VOM .VS? *.VSD *.VSMACROS *.VSS *.VST *.VSW *.VWP

*.VXD *.VXE *.WBK *.WBT *.WIZ *.WK? *.WML *.WMS *.WPC *.WPD *.WS *.WS? *.WSC

*.WSF *.WSH *.XL? .XL?? *.XLA *.XLS *.XLT *.XLW *.XML *.XNK *.XTP

29 Excluded File(s):

*.PST PAGEFILE.SYS *.TMP *.LDB *.MDB *.EDB *.FMB *.FMT *.FMX *.FRM *.INP

*.MDE *.MDF *.MDN *.MDW *.MDZ *.NDF *.ORA *.ORC *.OST *.SC *.SQC *.SQL *.SQR

*.STM *.TAR *.ZIP ???????? RECYCLER

Share
legcavadm02\CHECK$.

RPC request timeout=25000 milliseconds.

RPC retry timeout=5000 milliseconds.

High water mark=200.

Low water mark=50.

Scan all virus checkers every 10 seconds.

When all virus checkers are offline:

Shutdown Virus Checking.

Scan on read disable.

Panic handler registered for 65 chunks.

MS-RPC User: LEGCAVADM02$

MS-RPC ClientName: legcavadm02.CALEGIS.NET

Getting these events in sys_log

# tail -25 sys_log

135715691596108871985

135715692296108871986

135715903278929068036navi_event_str20118descHost SPA Storage Array APM00112303043 SP N/A SoftwareRev 7.31.25 (0.84) BaseRev 05. 8000.5.720 Description The array is alive. The heartbeat event is generated once every 7 day(s) on 20:36.

135715903496109133825SCRIPTNAMEPIDautomaticcollection[1883]8SCRIPTVERSION

3.248

135715903496108609561

135715955996109133826SCRIPTNAMEPIDautomaticcollection[1883]8TMPDIR/nas/var/emcsupport8

135715956196109133924SCRIPTNAMEPIDtransfer_support_materials[17944]8

135715960896109133929SCRIPTNAMEPIDtransfer_support_materials[17944]8SERVERftp.emc.com8NEWFILEsupport_materials_APM00112303043.130102_1237.zip8REMOTENAME/incoming/APM00112303043/logs8

135716048096108871980

135716051696108871985

135716052396108871986

135716408096108871980

135716411696108871985

135716412396108871986

135716767996108871980

135716771596108871985

135716772296108871986

13571677912135716778990468057105

13571677912135716778981878122526ipaddr165.107.16.2338statusAV_NOT_FOUND8winerror8ntstatusSUCCESS8

13571677912135716779090468057117ipaddr165.107.16.2278

13571677912135716779090468057117ipaddr165.107.16.2178

13571684812135716847981878122526ipaddr165.107.16.2338statusOFFLINE8winerror8ntstatusACCESS_DENIED8

13571685012135716850081878122526ipaddr165.107.16.2338statusOFFLINE8winerror8ntstatusCONNECTION_DISCONNECTED8

13571685412135716853381878122526ipaddr165.107.16.2338statusAV_NOT_FOUND8winerror8ntstatusSUCCESS8

Server_Log

2013-01-02 15:03:09: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:03:10: VC: 5: 29: Server 165.107.16.227 is online.

2013-01-02 15:03:10: VC: 5: 29: Server 165.107.16.217 is online.

2013-01-02 15:03:10: SMB: 4: Warning: RecvStream failed I/O error on server legcava03 (165.107.16.227) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:03:19: SMB: 4: last message repeated 3 times

2013-01-02 15:03:19: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:04:58: SMB: 4: last message repeated 9 times

2013-01-02 15:04:58: SMB: 3: lsarCloseHandle reported fault=CONTEXT_MISMATCH for client=165.107.16.217

2013-01-02 15:04:59: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:09:25: SMB: 4: last message repeated 26 times

2013-01-02 15:09:25: SMB: 4: Warning: RecvStream failed I/O error on server legcava02 (165.107.16.217) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:09:29: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:11:56: SMB: 4: last message repeated 14 times

2013-01-02 15:11:56: LGDB: 6: Restricted Groups enforced for legcavadm02

2013-01-02 15:11:59: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:13:06: SMB: 4: last message repeated 6 times

2013-01-02 15:13:06: SMB: 4: Warning: RecvStream failed I/O error on server legcava02 (165.107.16.217) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:13:09: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:13:11: SMB: 4: Warning: RecvStream failed I/O error on server legcava02 (165.107.16.217) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:13:19: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:14:29: SMB: 4: last message repeated 6 times

2013-01-02 15:14:29: SMB: 6: negotiate error status=c0000022

2013-01-02 15:14:39: SMB: 6: last message repeated 1 times

2013-01-02 15:14:39: RPC: 5: CLIENT::CLIENT3(avSvy) 0x005de4b608: Port acquisition failed for Rpc service 1062247 version 3 on hot 165.107.16.233

2013-01-02 15:14:39: VC: 3: 30: Error on CAVA server 165.107.16.233: OFFLINE, ntStatus: ACCESS_DENIED.

2013-01-02 15:15:00: RPC: 5: CLIENT::CLIENT3(avSvy) 0x047e6bdc08: Port acquisition failed for Rpc service 1062247 version 3 on hot 165.107.16.233

2013-01-02 15:15:00: VC: 3: 30: Error on CAVA server 165.107.16.233: OFFLINE, ntStatus: CONNECTION_DISCONNECTED.

2013-01-02 15:15:21: RPC: 5: CLIENT::CLIENT3(avSvy) 0x008fb5a408: Port acquisition failed for Rpc service 1062247 version 3 on hot 165.107.16.233

2013-01-02 15:15:32: RPC: 5: CLIENT::CLIENT3(avSvy) 0x00961b3808: Port acquisition failed for Rpc service 1062247 version 3 on hot 165.107.16.233

2013-01-02 15:15:33: VC: 3: 30: Error on CAVA server 165.107.16.233: AV_NOT_FOUND, ntStatus: SUCCESS.

2013-01-02 15:15:33: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:16:43: SMB: 4: last message repeated 6 times

2013-01-02 15:16:43: SMB: 4: Warning: SendStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:16:53: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:22:03: SMB: 4: last message repeated 30 times

2013-01-02 15:22:03: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:23:09: SMB: 4: last message repeated 6 times

2013-01-02 15:23:09: SMB: 4: Warning: RecvStream failed I/O error on server legcava03 (165.107.16.227) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:23:14: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:24:24: SMB: 4: last message repeated 7 times

2013-01-02 15:24:24: TIMESYNC: 6: Successful Hit 165.107.50.30

2013-01-02 15:24:33: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:29:43: SMB: 4: last message repeated 30 times

2013-01-02 15:29:43: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:31:06: SMB: 4: last message repeated 8 times

2013-01-02 15:31:06: SMB: 4: Warning: RecvStream failed I/O error on server legcava02 (165.107.16.217) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:31:13: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:32:03: SMB: 4: last message repeated 5 times

2013-01-02 15:32:03: SMB: 4: Warning: SendStream failed I/O error on server legcava03 (165.107.16.227) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:32:13: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:35:09: SMB: 4: last message repeated 17 times

2013-01-02 15:35:09: SMB: 4: Warning: SendStream failed I/O error on server legcava02 (165.107.16.217) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:35:13: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:37:07: SMB: 4:[VDM1] last message repeated 11 times

2013-01-02 15:37:07: LGDB: 6:[VDM1] Restricted Groups enforced for ldcemvault01

2013-01-02 15:37:13: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:37:27: SMB: 4:[VDM2] last message repeated 1 times

2013-01-02 15:37:27: LGDB: 6:[VDM2] Restricted Groups enforced for lcbemvault01

2013-01-02 15:37:33: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:39:58: SMB: 4: last message repeated 14 times

2013-01-02 15:39:58: SMB: 4: Warning: RecvStream failed I/O error on server legcava03 (165.107.16.227) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:40:03: SMB: 4: last message repeated 1 times

2013-01-02 15:40:03: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:45:13: SMB: 4: last message repeated 30 times

2013-01-02 15:45:13: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:47:47: SMB: 4:[LDCVDM03] last message repeated 15 times

2013-01-02 15:47:47: LGDB: 6:[LDCVDM03] Restricted Groups enforced for ldcfs03

2013-01-02 15:47:53: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:47:57: LGDB: 6:[LDCVDM04] Restricted Groups enforced for ldcfs04

2013-01-02 15:47:57: LGDB: 6:[LDCVDM05] Restricted Groups enforced for ldcfs05

2013-01-02 15:48:03: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:48:07: LGDB: 6:[LDCVDM06] Restricted Groups enforced for ldcfs06

2013-01-02 15:48:07: LGDB: 6:[LDCVDM07] Restricted Groups enforced for ldcfs07

2013-01-02 15:48:07: LGDB: 6:[LCBVDM02] Restricted Groups enforced for lcbfs02

2013-01-02 15:48:13: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:48:27: SMB: 4:[LCBVDM03] last message repeated 1 times

2013-01-02 15:48:27: LGDB: 6:[LCBVDM03] Restricted Groups enforced for lcbfs03

2013-01-02 15:48:27: LGDB: 6:[LHCVDM01] Restricted Groups enforced for lhcfs01

2013-01-02 15:48:33: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:52:53: SMB: 4: last message repeated 25 times

2013-01-02 15:52:53: SMB: 4: Warning: SendStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:53:03: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:54:43: SMB: 4: last message repeated 9 times

2013-01-02 15:54:43: SMB: 4: Warning: SendStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:54:53: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:59:09: SMB: 4: last message repeated 25 times

2013-01-02 15:59:09: SMB: 4: Warning: RecvStream failed I/O error on server legcava02 (165.107.16.217) port 445 with client legcvadm02 (165.107.16.171)

2013-01-02 15:59:13: SMB: 4: last message repeated 1 times

2013-01-02 15:59:13: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcvadm02 (165.107.16.171)

This looks suspicously like a Windows 2008 Firewall issue.  The RecvStream error points out that the VNX opened a TCP connection to the CAVA server, but it did not receive traffic back on port 445.  Take a look at Primus emc241731 and see if you need to add a rule to your Firewall settings.  In my case, I had to do this on each CAVA server.  Try this next and let us know how it goes!

Thanks Karl.  I've made the Windows Firewall excepts on the Windows CAVA servers as described in emc241731. I also changed registry setting as described in VEE 7.0 instructions on page 136 for the CEPA facilty to use McAfee which is our AV.  I made need to start the CEPA service...see server_log excerpts

2013-01-09 15:59:13: SMB: 4: Warning: RecvStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcavadm02 (165.107.16.171)

2013-01-09 16:00:43: SMB: 4: Warning: SendStream failed I/O error on server legcava03 (165.107.16.227) port 445 with client legcavadm02 (165.107.16.171)

2013-01-09 16:00:43: SMB: 4: Warning: RecvStream failed I/O error on server legcava02 (165.107.16.217) port 445 with client legcavadm02 (165.107.16.171)

2013-01-09 16:01:22: SMB: 4: Warning: SendStream failed I/O error on server legcava04 (165.107.16.233) port 445 with client legcavadm02 (165.107.16.171)

2013-01-09 16:25:05: SMB: 4: Warning: RecvStream failed I/O error on server legcava03 (165.107.16.227) port 445 with client legcavadm02 (165.107.16.171)

2013-01-09 16:25:54: SMB: 4: Warning: RecvStream failed I/O error on server legcava02 (165.107.16.217) port 445 with client legcavadm02 (165.107.16.171)

Have somebody configured CAVA ..

I am having some problem in configuring CAVA and in logs i am getting this

1423200539: VC: 5:  0 files processed by the AV threads.

1423200545: CMD: 6:  CmdReplicatev2List::initialize taskId:FL1001434006100000_0_4225802:4299193098

1423200548: CMD: 6:  CMD Context: List of all Cmd Contexts :

1423200548: CMD: 6:      Task_Id                 RefCount

1423200610: VC: 3: 4:  No virus checker server is available.

1423200610: VC: 5:  0 files in the collector queue.

1423200610: VC: 5:  0 files processed by the AV threads.

1423200615: CMD: 6:  CmdReplicatev2List::initialize taskId:FL1001434006100000_0_4225831:4299193127

1423200617: CMD: 6:  CMD Context: List of all Cmd Contexts :

1423200617: CMD: 6:      Task_Id                 RefCount

1423200679: VC: 3:30:  Error on CAVA server 10.153.0.78: ERROR_AUTH 53, ntStatus: SUCCESS.

1423200684: CMD: 6:  CmdReplicatev2List::initialize taskId:FL1001434006100000_0_4225860:4299193156

1423200686: CMD: 6:  CMD Context: List of all Cmd Contexts :

1423200686: CMD: 6:      Task_Id                 RefCount

1423200689: VC: 3:30:  Error on CAVA server 10.153.0.78: ERROR_AUTH 53, ntStatus: SUCCESS.

1423200689: SMB: 4:  Warning: RecvStream failed  I/O error  on server inpmp-web-tv002 (10.153.0.78) port 445 with client inpmp-fil-pp001 (10.153.0.42)

1423200709: SMB: 4:  last message repeated 1 times

1423200709: VC: 5:29:  Server 10.153.0.78 is online.

1423200720: SMB: 4:  Warning: select stream timeout  No error reported  on server inpmp-web-tv002 (10.153.0.78) port 445 with client inpmp-fil-pp001 (10.153.0.42)

1423200720: VC: 3:30:  Error on CAVA server 10.153.0.78: OFFLINE, ntStatus: CONNECTION_DISCONNECTED.

1423200720: VC: 3: 4:  No virus checker server is available.

1423200720: VC: 5:  0 files in the collector queue.

1423200720: VC: 5:  0 files processed by the AV threads.

^C

service@(none) spb:/EMC/C4Core/log>

service@(none) spb:/EMC/C4Core/log> tail -f c4_cdxic3_native.log

1423201049: VC: 5:  0 files in the collector queue.

1423201049: VC: 5:  0 files processed by the AV threads.

1423201070: VC: 3: 4:  No virus checker server is available.

1423201070: VC: 5:  0 files in the collector queue.

1423201070: VC: 5:  0 files processed by the AV threads.

1423201098: CMD: 6:  CmdReplicatev2List::initialize taskId:FL1001434006100000_0_4226034:4299193330

1423201100: CMD: 6:  CMD Context: List of all Cmd Contexts :

1423201100: CMD: 6:      Task_Id                 RefCount

1423201139: VC: 3:30:  Error on CAVA server 10.153.0.78: ERROR_AUTH 53, ntStatus: SUCCESS.

1423201149: SMB: 6:  negotiate error status=c000020c

1423201167: SMB: 6:  last message repeated 1 times

1423201167: CMD: 6:  CmdReplicatev2List::initialize taskId:FL1001434006100000_0_4226063:4299193359

1423201169: CMD: 6:  CMD Context: List of all Cmd Contexts :

1423201169: CMD: 6:      Task_Id                 RefCount

1423201169: SMB: 6:  negotiate error status=c000020c

1423201235: SMB: 6:  last message repeated 1 times

1423201235: CMD: 6:  CmdReplicatev2List::initialize taskId:FL1001434006100000_0_4226092:4299193388

1423201237: CMD: 6:  CMD Context: List of all Cmd Contexts :

1423201237: CMD: 6:      Task_Id                 RefCount

1423201240: SMB: 6:  negotiate error status=c000020c

1423201304: SMB: 6:  last message repeated 1 times

1423201304: CMD: 6:  CmdReplicatev2List::initialize taskId:FL1001434006100000_0_4226121:4299193417

1423201306: CMD: 6:  CMD Context: List of all Cmd Contexts :

1423201306: CMD: 6:      Task_Id                 RefCount

1423201309: SMB: 6:  negotiate error status=c000020c

1423201339: SMB: 6:  last message repeated 2 times

1423201339: VC: 5:29:  Server 10.153.0.78 is online.

1423201349: VC: 3: 4:  No virus checker server is available.

1423201349: VC: 5:  0 files in the collector queue.

1423201349: VC: 5:  0 files processed by the AV threads.

1423201369: VC: 3:30:  Error on CAVA server 10.153.0.78: ERROR_AUTH 53, ntStatus: SUCCESS.

1423201373: CMD: 6:  CmdReplicatev2List::initialize taskId:FL1001434006100000_0_4226150:4299193446

1423201374: CMD: 6:  CMD Context: List of all Cmd Contexts :

1423201374: CMD: 6:      Task_Id                 RefCount

1423201379: SMB: 6:  negotiate error status=c000020c

Any help is much appreciated

Regards,

Akshay Nandanwar

softcell

Hi Karl,

I also noticed today that when CAVA is running, some of the Files like Word files are taking a lot of time to close or for saving also. But what i observed today on my CAVA server/AV server , Ping from my CIFS  goes off for some time and then again come back, while I am saving some document or closing any file. This problem is intermittent . it happens some times and sometimes its not.

I would be grateful if you can  comment on this.

Regards,

Akshay Nandanwar

Softcell

Looking at your logs above, it looks like there's communication trouble between your NAS and your AV server.  If your ping traffic is taking some time to return, I think your networking is a possible problem.

I'd start by checking the network stack on the AV server - check for Firewall settings, check the netmask and routes, run a traceroute between the AV server and the NAS.  You will probably want to work with your network engineers as well, to see if they see large packet loss on the AV servers or NAS.  Maybe there's a switch in-between with errors?

Let us know if that helps!

Karl