Symptoms

There is a bulk request coming in due to many files getting written or modified simultaneously. There should be enough AV servers to scan the files. There are multiple errors of CAVA server in Unisphere: Severity : Error Message : Slot 2: high water mark reached. Full Description : The high water mark has been reached. Recommended Action : Verify that the CAVA (virus checker) servers are online. Event Code : 0x1310510002 User has enough AV servers but is still getting the "high water mark reached" error.

Cause

When the AV server gets a file scan request from the VNX, the AV servers queue up the files in order to process them sequentially. Error "Virus Checking: High water mark reached" occurs when the number of files queued to be scanned reaches the high water mark value (that is 200 by default). Warning "Virus Checking: Low water mark reached" occurs when the number of queued files falls and reaches the number stated in the low water mark. (That is 50 by default.)

Resolution

Verify that the Virus Checking servers are on line. server_viruschk server_x If the servers are online, increase the number of Virus Checking servers or increase the parameter values. Set the value using the following examples: parameter HighWaterMark=200 in /.etc/viruschecker.conf parameter LowWaterMark=50 in /.etc/viruschecker.conf If there are enough AV servers and the High WaterMark parameter value is set to more than the default value, and the same alert is still being received, then verify the maximum VC threads for data mover. .server_config server_x -v "param cifs maxVCThreads" Note: If a system has (6) CAVA servers, then increase this value to 6, so on .server_config server_x -v "param cifs maxVCThreads=6" After updating the maximum VC threads for the datamover, restart the CAVA services.

Support Cases