Support Center > Search Results > SecureKnowledge Details
"An error has occurred while extracting file" log from Threat Extraction blade when it blocks files attached to e-mails
Symptoms
  • Files attached to e-mails are blocked by the Threat Extraction blade with the following log in SmartView Tracker / SmartLog:

    Product: Threat Extraction
    Threat Extraction Activity: An error has occurred while extracting file
    Protection Name: Potential malicious content extracted
    Protection Type: Content Removal
    File Name: <Name_of_Attached_File>
    Service: smtp (25)
  • Debug of in.emaild.mta daemon (per sk60387) on Security Gateway shows:

    [emaild.mta PID ...]@GW_HostName[Date Time] email_policy_scrub_replace_part : failed to replace mime part rc=-1 mime_file_name=/opt/CPsuite-R77/fw1/tmp/email_tmp/emailtemp-... attachment_name=<Name_of_Attached_File> scrubbed_disk_file=/tmp/scrub/{...}/<Name_of_Attached_File>
    [emaild.mta PID ...]@GW_HostName[Date Time] email_policy_scrub_handle_scrub_result: email_policy_scrub_replace_part failed
    [emaild.mta PID ...]@GW_HostName[Date Time] mime_get_file_type_action: avift_new_file failed
    [emaild.mta PID ...]@GW_HostName[Date Time] email_policy_scrub_strip_attachment: mime_part_replace failed. rc=-1
    ... ...
    [emaild.mta PID ...]@GW_HostName[Date Time] [SCRUB (TD::All)] scrub_log_build_activity_str: Extracting activity: 'An error has occurred while extracting file'
Cause

This issue occurs when there are files in e-mail attachment with the same file name and file extension, but they differ only by the case of their detected file extension (e.g., "file.PDF" vs. "file.pdf", "file.DOCX" vs. "file.docx").


Solution
Note: To view this solution you need to Sign In .