Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Intrusion Defense Firewall (IDF) plug-in scan for recommendations fails in OfficeScan (OSCE) 11.0

    • Updated:
    • 24 Nov 2016
    • Product/Version:
    • OfficeScan 11.0
    • OfficeScan 11.0
    • Platform:
    • Windows 2008 Server R2 Enterprise
    • Windows 2008 Standard
    • Windows 2008 Standard 64-bit
    • Windows 2012 Enterprise
    • Windows 2012 Enterprise R2
    • Windows 2012 Standard
    • Windows 2012 Standard R2

Scan for recommendations using IDF fails in OSCE 11.0 and results in "Scan for Recommendations Pending (Offline)".

Sample errors include:

"An error occurred in the IDF Server Plug-in to IDF Client Plug-in/Appliance protocol: SocketException: Socket is closed."

Windows Event errors : 10016 and/or 740


To resolve the issue, increase the socket timeout value:

  1. Go to the IDF server host and open the CMD window.
  2. Switch the path to the IDF server installation folder.
  3. Run the following commands:

    idf_c.exe -action changesetting -name configuration.defaultSocketChannelTimeout -value 600000
    idf_c.exe -action changesetting -name configuration.agentSocketTimeoutOverride -value 600

The commands will request to restart the IDF server. After restarting IDF, the timeout value will be extended to 600 seconds for both client and server. For the configuration.defaultSocketChannelTimeout parameter, the value will be 600000 milliseconds.

If the issue is still present after following the steps above, try the following:

  • Set the CPU usage level to High.

    This gives the scan more CPU power to finish. This is essential if a lot of the machines do the Recommendation Scan. Medium CPU usage level would not be enough for this kind of situation. Set it to high (which will use 100%) if there is no concern about it.

  • Set the configuration.defaultSocketChannelTimeout parameter to a bigger value.

    Usually, the value should not be larger than 30 minutes (1,800 seconds or 1,800,000 mini-seconds) to prevent some unknown side effect. If it cannot finish in 30 minutes, the machine CPU power is insufficient to do the job.

  • Separate the machines to be scanned into several groups in different time periods for scanning.

    If 100% CPU usage and max timeout are not enough, this is another way to reduce the failure rate. Separate them into groups for different times, so that the IDF server can finish each group in the given time. This is the last resort to solve the issue without upgrading the hardware (i.e. CPU power). Don't put the failure machines in one group since those machines would require more time to finish the scan.

  • If all the aforementioned are not working or not good enough, then the best way to resolve the issue is to increase the IDF server's CPU power. If it's a VM, this should be easily done.
Configure; Troubleshoot; SPEC
Solution Id:
Did this article help you?

Thank you for your feedback!

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.