Support Center > Search Results > SecureKnowledge Details
"An error has occurred while extracting file" log from Threat Extraction blade when it blocks files attached to e-mails Technical Level
  • Files attached to e-mails are blocked by the Threat Extraction blade with the following log in SmartView Tracker / SmartLog:

    Product: Threat Extraction
    Threat Extraction Activity: An error has occurred while extracting file
    Protection Name: Potential malicious content extracted
    Protection Type: Content Removal
    File Name: <Name_of_Attached_File>
    Service: smtp (25)
  • Debug of in.emaild.mta daemon (per sk60387) on Security Gateway shows:

    [emaild.mta PID ...]@GW_HostName[Date Time] email_policy_scrub_replace_part : failed to replace mime part rc=-1 mime_file_name=/opt/CPsuite-R77/fw1/tmp/email_tmp/emailtemp-... attachment_name=<Name_of_Attached_File> scrubbed_disk_file=/tmp/scrub/{...}/<Name_of_Attached_File>
    [emaild.mta PID ...]@GW_HostName[Date Time] email_policy_scrub_handle_scrub_result: email_policy_scrub_replace_part failed
    [emaild.mta PID ...]@GW_HostName[Date Time] mime_get_file_type_action: avift_new_file failed
    [emaild.mta PID ...]@GW_HostName[Date Time] email_policy_scrub_strip_attachment: mime_part_replace failed. rc=-1
    ... ...
    [emaild.mta PID ...]@GW_HostName[Date Time] [SCRUB (TD::All)] scrub_log_build_activity_str: Extracting activity: 'An error has occurred while extracting file'

This issue occurs when there are files in e-mail attachment with the same file name and file extension, but they differ only by the case of their detected file extension (e.g., "file.PDF" vs. "file.pdf", "file.DOCX" vs. "file.docx").

Note: To view this solution you need to Sign In .