> Source: [sk135392](https://support.checkpoint.com/results/sk/sk135392)

# sk135392 - Files are pending in Threat Emulation, and many VM failures can be found on the emulator

| Property | Value |
|----------|-------|
| Solution ID | sk135392 |
| Date Created | 2018-08-30 |
| Last Modified | 2018-10-21 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |
| Platform | TE |

## Symptoms

- * From *ted debug* log, some files may appear as "PENDING" for a long time.
* Many VM failures can be found:  
  \[TE_TRACE (TD::Important)\] te::Emulation::EmulationInvestigator::HandleInternalCommunicationError: VM 331 (5e5de275-a103-4f67-b55b-47532918fa59) : Internal Communication Error just happened: SymoClient not responding  
  \[TE_TRACE (TD::Important)\] te::Emulation::EmulationInvestigator::HandleInternalCommunicationError: {0BBB64D7-1EA2-7845-8BE6-402B8823479B} VM 331 number of internal communication errors for this file = 1, threshold: 3 VM state: Emulating  
  \[TE_TRACE\]: {0BBB64D7-1EA2-7845-8BE6-402B8823479B} Adding emulation request on Image: '5e5de275-a103-4f67-b55b-47532918fa59', Run: 1, Priority: high (139 requests in queue, 9 running emulation VMs)  
  \[TE_TRACE\]: VM 331 KeyPoint: Terminating (error occured? 0, detected events: 0 malicious, 0 benign)  
  \[TE_TRACE\]: GlobalKeyPoint: stop processing requests due to resources shortage \[TE_TRACE (TD::Important)\] te::Emulation::EmulationInvestigator::HandleInternalCommunicationError: VM 23364 (5e5de275-a103-4f67-b55b-47532918fa59) : Internal Communication Error just happened: Failed to connect to SYMO client \[TE (TD::Important)\] te::Emulation::EmulationInvestigator::HandleInternalCommunicationError: VM 23364: Total Files: 1 \[TE (TD::Important)\] te::Emulation::EmulationInvestigator::HandleInternalCommunicationError: VM 23364: Current files: 1 \[TE_TRACE (TD::Important)\] te::Emulation::EmulationInvestigator::HandleInternalCommunicationError: {AD2BB696-D8D0-0A4C-BC76-2482AF2A5D81} VM 23364 number of internal communication errors for this file = 3, threshold: 3 VM state: Creation In Process \[TE (TD::Surprise)\] te::Emulation::EmulationInvestigator::HandleInternalCommunicationError: {AD2BB696-D8D0-0A4C-BC76-2482AF2A5D81} VM 23364: Terminating the VM due to increase number of VM errors (3) \[TE_TRACE\]: VM 23364 KeyPoint: Terminating VM due to error: Failed to connect to SYMO client

## Cause

The probable cause is that a process in the appliance (*ted* ) tries to talk to another process in the appliance (*qemu*) using a virtual interface, with address space 169.254.x.x.

Threat Emulation creates virtual interfaces (*vm-ifXX)* to create a private network with the VMs it runs. After a long run, you may get a wrong interface index, which causes Threat Emulation to fail.

Once this happens, only reboot resolves the issue.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content