KB Article #102597
Decompression and decomposition errors
Decompression and decomposition errors
Symptom:
A brief explanation of some decompression and decomposition related issues
Errors in event log:
content decomposition failure
-- The failure occurred while processing an unnamed message body part
Internal Processing error - an Internal Error has occurred - decomposition processing
Archive Decompression Error
-- Error 0x80004005 while trying to decompress attachment file.zip
Messages in Quarantine for the following reason:
An internal error has occurred. Save this message and contact Tumbleweed technical support.
Error details:
Plugin: Content Manager, State: Decomposition, Stage: 0x8000
Reason code: 0x80004005.
Detailed Information:
EMF uses third party software in order to thoroughly process some attachments:
We use EllTech and DynaZip to handle the decompression of compressed file types such as zips and self extracting exe's.
We use Verity to handle decomposition of most common attachment types (documents, spreadsheets, image files, etc.)
There are a couple of different types of errors that fit into this category.
*** Decompression errors ***
This error in general means that an executable or zip file could not be decompressed so that its contents could be scanned by the content manager. Although this decompression engine may be used to enhance virus scanning of archives, the Olympus Virus Engine contains its own decompression engine, therefore is not affected by decompression errors. Files that are subject to decompression include, but are not limited to: .Zip files, Unix Tar and Jar files, GZIP files, self extracting executables, and other archive files.
Some common reasons that decompression errors might occur:
1. Temp file location out of disk space or not a valid directory. If the EMF Policy Engine Service can't create temp files to perform decompression, a decompression error will be generated. See the related article Where EMF writes temp files on the right for info about temp file locations.
2. Corrupt archive files inherently can't be opened or decompressed, even by the application they are created by. Corrupt archives generally cause decompression errors.
3. The Message Decomposition timeout is reached. Event 6172 (Archive Decompression Error) will be logged, indicating the timeout value.
4. The EMF decompression engines experience a problem decompressing a file.
*** Decomposition errors ***
These errors are returned by the Verity decomposition engine when an error occurs during the type identification or content (text) extraction process for some attachment or body part of a message. As with Decompression errors, this engine is used to enforce Content Manager policies and does not affect the Virus Managers ability to detect viruses.
The ability of EMF to decompose attachments can be affected by many of the same situations as decompression:
1. Temp file location out of disk space or not a valid directory. If the EMF Policy Engine Service can't create temp files to perform decompression, a decompression error will be generated. See the related article Where EMF writes temp files on the right for info about temp file locations.
2. Corrupt files inherently can't be opened, even by the application they are created by. Corrupt files generally cause decomposition errors.
3. The EMF decomposition engine experiences a problem decomposing a file.
4. EMF can be configured to mark unrecognized MIME parts as having caused decomposition failures.
Dealing with decomposition and decompression errors
* Tumbleweed typically includes updates to the Verity engines in newer versions and patches. Updates to the decompression engines are also often included. If you are seeing decompression or decomposition errors, it is recommended that you upgrade to the latest version and build available.
* You should verify that the location that temp files are being written has enough disk space and has write permissions. Make sure you know what acct the EMF Policy Engine Service logs in as, and check the temp and tmp environment variables for this account.
* You should verify that the files in question are not corrupt and that the application that they belong to is able to open them. For example, WinZip can open a .zip file, and Microsoft Word can open a Word document or .doc file.
* Consider changing the policies that define how messages that cause Decomposition errors or Decompression errors are handled. The "Decomposition Errors" and "Decompression Errors" policies are both default policies applied to the ALL folder. The Decompression Errors policy is set to quarantine messages that cause this error, while the Decomposition policy is configured to process normally. The quarantine queue is designed to temporarily hold messages so that they can be reviewed by an administrator to determine the risk of delivery. If the quarantine queue will not be reviewed regularly, it may be appropriate to not quarantine these messages, but instead allow them to be delivered, or "processed normally". These policies can be further modified to handle messages that cause errors differently based on other criteria, such as sender or recipient. It is also possible to write a new File attachment stripping policy to completely remove from a message, any files that cause decompression or decomposition errors. It is important to remember that these errors affect enforcement of Content Manager policies only, and do not affect detection of viruses. Please see the online help for information on creating and modifying policies.
* Any messages that get quarantined despite the policy to process normally (described above) should be sent to the Tumbleweed Technical Assistance Center for review. These messages can be saved from the quarantine queue using the "save message to file" button.
* If a Message Decomposition size or nesting depth or timeout is hit, the size or nesting depth or timeout can be increased. See related article Decomposition Limits (2056).
Although we are continually making improvements to our code, and 3rd parties making improvements to their code, identifying and extracting text from all file types is a challenging task. For example, Verity is attempting to reverse-engineer every file format of all software types. 100% success should not be expected and failures on a semi-regular basis are not unusual. We do make every attempt to anticipate changes, but new file types are appearing all the time. In some cases our customers are the first to bring problem file types to our attention.
If you receive any decomposition or decompression type errors, please make sure you are at the latest release of EMF. If you are, please forward copies of the problematic messages to support for analysis. If you are not currently on the latest release, support should be able to tell you if the problem you're seeing has already been fixed.