Tag Archives: process

Watchguard XTM Firewall UTM Device – Cannot browse some sites and logs report GAV job open failed (failed to connect to scand at scand)

Cannot browse some sites and logs report GAV job open failed (failed to connect to scand at scand)

You may find that you cannot access or browse some websites when you are using a Watchguard XTM Firewall or UTM device and the GAV (gateway antivirus) is enabled.  When you review the appliance logs you see the following event logged GAV job open failed (failed to connect to scand at scand).  In this instance the anti-virus proces or component of the XTM device has probably crashed or stopped responding.

Resolution/Workaround:

You might be able to permantently resolve this issue by upgrading to a newer XTM OS i.e. 11.4.2 to 11.5.2 or you may simply need to apply the latest CSP release for the XTM OS build you are using i.e. 11.4.2 CSP9 (Service Pack).  Newer OS releases and Service Packs often included fixes for these sorts of GAV issue.

A workaround would be to schedule a reboot of your Watchguard XTM appliance, this will reset the GAV (gateway antivirus) and should allow pages to load correctly again.

[RESOLVED] A process that is being terminated stops responding in Windows 7 or Windows Server 2008 R2 or Small Business Server 2011

You may find that when you try to terminate a process on Windows 7, Windows Server 2008 R2, Windows Small Business Server 2011 SBS 2011 that the termination process stops responding.  The main thread of the process becomes blocked and if you analyse the call stack of the process you will see that a thread is blocked in the ntdll!NtReleaseKeyedEvent() function.  This occurs because of a race condition whereby the main thread that is trying to terminate the process also tries to reactivate another thread when the thread released an SRW lock.

This issue can be resolved by installing a hotfix containing an updated Ntdll.dll driver.  You can find the hotfix download link in Microsoft KB 2582203 http://support.microsoft.com/kb/2582203