Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Deep Security Agent causes SMB timeout error on file server

    • Updated:
    • 17 Aug 2018
    • Product/Version:
    • Deep Security 10.0
    • Platform:
    • N/A N/A
Summary

File server may experience SMB timeout error. In addition, it may show coreServiceShell.exe with high CPU usage.

Below is a sample error event shown in the Application Event Log:

Log Name: Microsoft-Windows-SMBServer/Operational  Source: Microsoft-Windows-SMBServer  Date: 11/20/2017 6:06:36 PM  Event ID: 1020  Task Category: (1020)  Level: Warning  Keywords: (8)  User: SYSTEM  Computer: ************************  Description:  File system operation has taken longer than expected.  Client Name:   xx.xx.xx.xx  Client Address: xx.xx.xx.xx:xxxxx  User Name: ***********\*******************  Session ID: 0x8600004004681  Share Name: ********************  File Name: *******\Agent Workspace\log\AgentWorkspace.log  Command: 5  Duration (in milliseconds): 17931  Warning Threshold (in milliseconds): 15000  
Details
Public

Upon checking the AMSP debug log, there are multiple timeout threads.

Line 144551: 2017/11/29 10:48:15.262,[11664:10200],[FATAL],[Plugin System Adapter], !!! Found timeout thread[0x2c94] state=0x1, move thread to timeout list, interval=0x4fc6,[AdapterEventThreadPool.cpp(3358)]  Line 144554: 2017/11/29 10:48:15.262,[11664:10200],[FATAL],[Plugin System Adapter], !!! Found timeout thread[0xd50] state=0x1, move thread to timeout list, interval=0x4f69,[AdapterEventThreadPool.cpp(3358)]  Line 144558: 2017/11/29 10:48:15.262,[11664:10200],[FATAL],[Plugin System Adapter], !!! Found timeout thread[0x11e4] state=0x1, move thread to timeout list, interval=0x4ead,[AdapterEventThreadPool.cpp(3358)]  Line 144561: 2017/11/29 10:48:15.262,[11664:10200],[FATAL],[Plugin System Adapter], !!! Found timeout thread[0x3360] state=0x1, move thread to timeout list, interval=0x53ae,[AdapterEventThreadPool.cpp(3358)]  Line 144564: 2017/11/29 10:48:15.262,[11664:10200],[FATAL],[Plugin System Adapter], !!! Found timeout thread[0x212c] state=0x1, move thread to timeout list, interval=0x4e20,[AdapterEventThreadPool.cpp(3358)]

These threads show that the scanning job was completed, but got stuck at updating the CRC cache. The CRC cache function is a legacy feature that is no longer used.

Deep Security Agent 10.0 Update 6 includes the latest AMSP module containing the fix for issues related to SMB timeout. It is recommended to upgrade to this version.

Premium
Internal
Rating:
Category:
Troubleshoot
Solution Id:
1120188
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.