Summary
File server may experience SMB timeout error. In addition, it may show coreServiceShell.exe with high CPU usage.
Below is a sample error event shown in the Application Event Log:
Log Name: Microsoft-Windows-SMBServer/Operational Source: Microsoft-Windows-SMBServer Date: 11/20/2017 6:06:36 PM Event ID: 1020 Task Category: (1020) Level: Warning Keywords: (8) User: SYSTEM Computer: ************************ Description: File system operation has taken longer than expected. Client Name: xx.xx.xx.xx Client Address: xx.xx.xx.xx:xxxxx User Name: ***********\******************* Session ID: 0x8600004004681 Share Name: ******************** File Name: *******\Agent Workspace\log\AgentWorkspace.log Command: 5 Duration (in milliseconds): 17931 Warning Threshold (in milliseconds): 15000
Details
Upon checking the AMSP debug log, there are multiple timeout threads.
Line 144551: 2017/11/29 10:48:15.262,[11664:10200],[FATAL],[Plugin System Adapter], !!! Found timeout thread[0x2c94] state=0x1, move thread to timeout list, interval=0x4fc6,[AdapterEventThreadPool.cpp(3358)] Line 144554: 2017/11/29 10:48:15.262,[11664:10200],[FATAL],[Plugin System Adapter], !!! Found timeout thread[0xd50] state=0x1, move thread to timeout list, interval=0x4f69,[AdapterEventThreadPool.cpp(3358)] Line 144558: 2017/11/29 10:48:15.262,[11664:10200],[FATAL],[Plugin System Adapter], !!! Found timeout thread[0x11e4] state=0x1, move thread to timeout list, interval=0x4ead,[AdapterEventThreadPool.cpp(3358)] Line 144561: 2017/11/29 10:48:15.262,[11664:10200],[FATAL],[Plugin System Adapter], !!! Found timeout thread[0x3360] state=0x1, move thread to timeout list, interval=0x53ae,[AdapterEventThreadPool.cpp(3358)] Line 144564: 2017/11/29 10:48:15.262,[11664:10200],[FATAL],[Plugin System Adapter], !!! Found timeout thread[0x212c] state=0x1, move thread to timeout list, interval=0x4e20,[AdapterEventThreadPool.cpp(3358)]
These threads show that the scanning job was completed, but got stuck at updating the CRC cache. The CRC cache function is a legacy feature that is no longer used.
Deep Security Agent 10.0 Update 6 includes the latest AMSP module containing the fix for issues related to SMB timeout. It is recommended to upgrade to this version.
