error: too many values to unpack

kostasthedelegate · ‎07-20-2021

Hello,

Has anyone seen this message:

The Critical message is:

Txn 4342810 BinaryScanId[348189] data_response_handler error: too many values to unpack

Product: Cisco S300V Web Security Virtual Appliance

Model: S300V

Version: 12.5.1-043

Any hint?

Here are the amp logs related

Tue Jul 20 11:14:32 2021 Info: Txn 4342810 Binary scan on instance[0] Id[348189]: AMP allocated memory = 1048576, AMP used memory = 46641, Scans in flight = 2, Active faster connections = 2, Active slower connections = 0

Tue Jul 20 11:16:03 2021 Critical: Txn 4342810 BinaryScanId[348189] data_response_handler error: too many values to unpack

Tue Jul 20 11:16:03 2021 Info: Binary scan on instance[0] id[348189]: filename[e640e707-46e9-475f-801e-50338e9b7546] filemime[application/zip] file_extension[None] length[639562b] amperrorverdict[(3, 0, 4, '', 0, 0, '', '')] is_slow[0], scans_in_flight[2], Active faster connections[2], Active slower connections[0]

Milos_Jovanovic · ‎08-03-2021

Hi,

Based on he output, it looks to me that you are reaching a limit of nested archives, which means that you have file which is archived multiple times.

According to documentation, max scanable nested archive can be up to 5 levels, but, based on couple of production WSAs that I have, it looks that it is configured at 2 by default (which is contributing to my theory).

You can check this under Security Services / Acceptable Use Controls. Also, you can try to increase it to max of 5 (which can have negative impact on WSA) and check if that helpes (ideally, if you can reproduce it with same file).

BR,

Milos