(14001) Internal antivirus filter error: cannot call Anti-Malware engine - all connections in use

[User79733044]

We have the McAfee Web Gateway 9.2xx. The error "(14001) Internal antivirus filter error: cannot call Anti-Malware engine - all connections in use" occurs when jobs in the queue exceeds the 1000 threshold. We want the proxy to fail open when this error occurs so we set  the "Block on Anti-Malware Engine Errors" Rule to "Allow and send Email", but connections are still being blocked.

The error information is as follows:

Current Rule ID: 2897

Current Rule Name: Block If Virus Was Found

Error Message: (14001) Internal antivirus filter error: cannot call Anti-Malware engine - all connections in use

[AaronT · Accepted solution]

@User79733044 

You need to create an Error Handler rule.  It will go something like this.

Click on Rule Sets, then "Error Handler" section (on the bottom)

(This is our setting, yours might differ)

Click on the Default ->Error_Handler -> Block on Anti-Malware Engine Errors Ruleset

Create a rule as follows:

Name: "EngineError: Anti-Malware Engine (Overloaded)"
Criteria: "Error.ID equals 14001
Action: Stop Cycle
Events: Email.Send("notification_email[at]yourdomain.com", System.HostName, "The Antimalware Engine is Overloaded, please examine the mwg-antimalware-errors.log file for more information")<E-mail Server>

This rule will handle error ID 14001 as a stop cycle and send an email to your support team.  I believe this is what you wanted?

[User79733044]

Perfect, thanks!