argument list too long (when deleting files from the Endpoint Security for Mac Quarantine directory fails)

技術的な記事 ID: KB90378
最終更新: 7/24/2020

環境

McAfee Endpoint Security for Mac (ENSM) Threat Prevention 10.x

概要

This article describes how to manually delete quarantined files in the Terminal for ENSM.

問題

Excessive numbers of quarantined files are present in the /Quarantine directory. Normal rm ./* commands fail with the following error:

argument list too long

解決策

Delete the quarantined files as follows:

Open a Terminal session locally on the system.
Log on as su and enter your password.
Navigate to the Quarantine directory:

(ENSM 10.6.4 and later) cd /usr/local/Quarantine
(ENSM 10.6.3 or earlier) cd /Quarantine
Confirm that you are in the Quarantine directory:

pwd
Stop the Functional Module Platform (FMP) service on the client:

/usr/local/McAfee/fmp/bin/fmp stop

The appropriate output is similar to the following:

stopping...
2246
stopped gracefully
List the files in the directory:

ls
Choose a file. It looks similar to this example:

Q16777229.12308144.436871.000.file
Try to delete the file (example file name: Q16777229.12308144.436871.000.file):

rm Q16777229.12308144.436871.000.file

If you can successfully delete the file, you can continue to the next step of removing files by octet.
Start deleting files from the second octet:

rm Q16777229.123081*

If this command returns the error "argument list too long", go to the next digit on that file:

rm Q16777229.1230814*

Below is a list of how you would run the rm command from the Terminal to delete the files from that octet:

rm Q16777229.123081*
rm Q16777229.123082*
rm Q16777229.123083*
rm Q16777229.123084*
rm Q16777229.123085*
rm Q16777229.123086*

If all these files delete successfully, you can continue to the next step.
Start deleting files from the next digit:

rm Q16777229.12308*

Delete the files that have the largest argument list first, and then work your way down to the smaller files. The following command shows you how many files match the first octet and follow numeric values for the second octet:

ls Q16777229.12308* | wc -l

Example: 74931
After you finish with the above commands and output files, delete the rest of the contents:

rm Q*

If this command completes successfully, continue to the next step.
Run the ls command again to make sure that all files are deleted. If all files are successfully deleted from the Terminal, check the ENSM console to verify that all quarantined entries are removed. If there are entries present, a restart does not fix the issue. Return to the Terminal and check whether the following entries display in the Quarantine directory:

.Quarantine.lck and .Quarantine.meta

Check whether there is a size associated with either file:

Example:

.Quarantine.meta 29014792
.Quarantine.lck 0

If there is a size for either file, run the following command:

rm .Quarantine.*

Run the command ls -la and check whether the files still exist. If nothing is present, you can continue to the next step.
Start the FMP service:

/usr/local/McAfee/fmp/bin/fmp start
Open the ENSM console and confirm that there are no entries in the Quarantine directory.

影響を受ける製品

Endpoint Security for Mac Threat Prevention 10.x

言語:

この記事は、次の言語で表示可能です:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

技術用語集

用語集にある用語をハイライトする

当社の技術用語集を参照してください。

Knowledge Center

argument list too long (when deleting files from the Endpoint Security for Mac Quarantine directory fails)

環境

概要

問題

解決策

影響を受ける製品

言語:

技術用語集

Title

Title

Knowledge Center

argument list too long (when deleting files from the Endpoint Security for Mac Quarantine directory fails)

環境

概要

問題

解決策

影響を受ける製品

言語:

技術用語集

地域を選択してください

Title

Title