No vscan servers are connected

[#1]

Hi All,

I got below above error when i issue vscan command. Some error captured from /etc/messages

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Sun Oct 17 00:00:41 CST [filer1: cifs.pipe.errorMsg:error]: CIFS: Error on named pipe with SCANSERV: Error connecting to server, open pipe failed

Sun Oct 17 00:00:41 CST [filer1: cifs.server.infoMsg:info]: CIFS: Warning for server \\SCANSERV: Connection terminated.

Sun Oct 17 00:00:41 CST [filer1: vscan.server.connectError:error]: CIFS: An attempt to connect to vscan server \\SCANSERV failed [0xc000005e].

Sun Oct 17 00:00:41 CST [filer1: vscan.dropped.connection:warning]: CIFS: Virus scan server \\SCANSERV (111.222.333.83) has disconnected from the filer.

Sun Oct 17 00:01:32 CST [filer1: vscan.server.connecting.successful:info]: CIFS: Vscan server \\SCANSERV registered with the filer successfully.

Sun Oct 17 00:03:29 CST [filer1: cifs.pipe.errorMsg:error]: CIFS: Error on named pipe with SCANSERV: Error connecting to server, open pipe failed

Sun Oct 17 00:03:29 CST [filer1: cifs.server.infoMsg:info]: CIFS: Warning for server \\SCANSERV: Connection terminated.

Sun Oct 17 00:03:29 CST [filer1: vscan.server.connectError:error]: CIFS: An attempt to connect to vscan server \\SCANSERV failed [0xc000005e].

Sun Oct 17 00:03:29 CST [filer1: vscan.dropped.connection:warning]: CIFS: Virus scan server \\SCANSERV (111.222.333.83) has disconnected from the filer.

Sun Oct 17 00:04:03 CST [filer1: vscan.server.connecting.successful:info]: CIFS: Vscan server \\SCANSERV registered with the filer successfully.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

cifs domaininfo shows it is connected to the domain, I found that i can ping to the SCANSERV from admin server but cannot nslookup.

from the log it show when it first happen

~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Tue Sep 28 04:25:17 CST [filer1: vscan.server.fqdn.unavail:error]: CIFS: Could not determine Fully Qualified Domain Name (FQDN) of virus vcanning (vscan) server (111.222.333.83). If the vscan server is running on the Microsoft Longhorn OS, the storage system requires vscan server FQDN for authenticating itself to the vscan server.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~

cat nsswitch.conf

hosts: files       dns

cat hosts

#############################################

# SCAN SERVERS

#############################################

111.222.333.83   SCANSERV

cat resolv.conf

nameserver 111.222.333.199

Is it the filer could find the FQDN virus scan server that cause it is disconnected from it. But how to prove and solve it.

Thanks

[#2]

Looks like somebody messed up the DNS entry.

Try changing the /etc/hosts entry to a FQDN:

111.222.333.83   SCANSERV.mydomain.com

Also, have the DNS records fixed. SCANSERV should have good forward and reverse resolution...

At your service,

Eugene Kashpureff

[#3]

Hi there,

1) fix dns/hosts

2) make sure date & time on both, netapp & server, matches and syncs from the same time source

Kind regards

Thomas

[#4]

yes i now there is something wrong with the DNS. But what makes me confused..

I'm able to ping the SCANSERV. But i couldn't run nslookup to it.

[#5]

hi,

1) refer to my previous post, seen below

2) refer to official netapp knowledgebase article https://now.netapp.com/Knowledgebase/solutionarea.asp?id=kb23660

kind regards

thomas

[#6]

So I just fixed this issue in my customers environment and wanted to make sure no one else ran into the same thing and ran out of options. I found the following KB from McAfee https://kc.mcafee.com/corporate/index?page=content&id=KB68524

Solution 2 worked for me which was to:

"

Solution 2

     ...

     Enable Network access: Let Everyone permissions apply to anonymous users

          1. Click Start, Administrative Tools, Local Security Policy.

          2. Expand Local Policies and click Security Options.

          3. Scroll down and double-click Network access: Let Everyone permissions apply to Anonymous users

          4. Click Enable, OK

          5. Restart the computer

          6. Check the logs to verify the issue is resolved

"

I am not sure if this is against anyone's security policies but as far as I read this it aligns the permissions and makes the group "Everyone" to "Anonymous".

Let me know if this helps anyone.

-Rich

[#7]

Hi.

I think your "vscan.server.fqdn.unavail:error" error message kind of says it all.

We use Trend on W2K8 R2 in our environment. If you do so, too, this may be a helpful link:

https://esupport.trendmicro.com/solution/en-us/1059754.aspx

Regards

Anton