error: too many values to unpack
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-20-2021 04:29 AM
Hello,
Has anyone seen this message:
The Critical message is:
Txn 4342810 BinaryScanId[348189] data_response_handler error: too many values to unpack
Product: Cisco S300V Web Security Virtual Appliance
Model: S300V
Version: 12.5.1-043
Any hint?
Here are the amp logs related
Tue Jul 20 11:14:32 2021 Info: Txn 4342810 Binary scan on instance[0] Id[348189]: AMP allocated memory = 1048576, AMP used memory = 46641, Scans in flight = 2, Active faster connections = 2, Active slower connections = 0
Tue Jul 20 11:16:03 2021 Critical: Txn 4342810 BinaryScanId[348189] data_response_handler error: too many values to unpack
Tue Jul 20 11:16:03 2021 Info: Binary scan on instance[0] id[348189]: filename[e640e707-46e9-475f-801e-50338e9b7546] filemime[application/zip] file_extension[None] length[639562b] amperrorverdict[(3, 0, 4, '', 0, 0, '', '')] is_slow[0], scans_in_flight[2], Active faster connections[2], Active slower connections[0]
- Labels:
-
Web Security
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-03-2021 05:35 AM
Hi,
Based on he output, it looks to me that you are reaching a limit of nested archives, which means that you have file which is archived multiple times.
According to documentation, max scanable nested archive can be up to 5 levels, but, based on couple of production WSAs that I have, it looks that it is configured at 2 by default (which is contributing to my theory).
You can check this under Security Services / Acceptable Use Controls. Also, you can try to increase it to max of 5 (which can have negative impact on WSA) and check if that helpes (ideally, if you can reproduce it with same file).
BR,
Milos
