Ironport C170 Warning: McAfee watchdog thread terminated and will restart

[Lothar Schneider]

Always I send a Mail across the Ironport C170 the McAfee-Virusscanner produced the following message:

Wed Aug 31 07:17:46 2016 Warning: McAfee watchdog thread terminated and will restart. Error was: ('_coro.pyx coro._coro.coro.__yield (coro/_coro.c:5318)|348', "<class 'fast_rpc.RPC_Server_Unreachable'>", '', '[egg/mcafee.py mcafee_watchdog|232] [egg/mcafee.py _mcafee_watchdog|257] [_coro.pyx coro._coro.sched.with_timeout (coro/_coro.c:11762)|1099] [egg/mcafee_rpc_client.py avscan|30] [egg/fast_rpc_proxy.py __method_caller__|20] [egg/fast_rpc.py request|261] [sync.pyx coro._coro.condition_variable.wait (coro/_coro.c:30276)|621] [sync.pyx coro._coro.condition_variable._wait (coro/_coro.c:30218)|612] [sync.pyx coro._coro._wait (coro/_coro.c:30165)|609] [_coro.pyx coro._coro.coro.__yield (coro/_coro.c:5318)|348]')

What is the probelm?

Thanks for  responses.

[Enrico Werner]

You should find out if the event is associated with particular type of messages. Run grep on the CLI and search for the following in the text mail log file:

antivirus server error

This will give you the MID and with findevent you can get all details for each MID.

Also, check in the antivirus log file how often the watchdog error shows up. If you can link the events to some of your messages you can look into what you are sending through the ESA. If the events show too often I would suggest to open a case with TAC.

Addtionally make sure your AsyncOS version is a supported one!

[Lothar Schneider]

Thanks for your Response.

The error message occurs every time, if an email accros the c170.

The AsyncOS is the latest.

[Libin Varghese]

Lothar,

The error suggests mcafee scanning engine is restarting when attempting to scan an email,I would agree with Enrico this would need a TAC case to review logs on the appliance and determine cause for the engine restarting.

Upgrading the appliance to a newer release may fix the issue, however it would be difficult to comment on what caused the issue without looking at the logs.

Thanks

Libin

[Lothar Schneider]

Hello,

thanks for your Response.

We will open a case with TAC.

Lothar