> Source: [sk148935](https://support.checkpoint.com/results/sk/sk148935)

# sk148935 - "Emulation ended with errors " log for Threat Emulation

| Property | Value |
|----------|-------|
| Solution ID | sk148935 |
| Date Created | 2019-03-11 |
| Last Modified | 2019-05-21 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Following "Emulation ended with errors (Failed to process the file)" Log is found in SmartLog:   

  ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk148935/Emulation_Ended19031104011903120740.PNG)
* The emulated file can not be found in the debug files \[$FWDIR/log/ted.elg\*\].
* Performing Kernel Debug (fw ctl debug -m dlpk + all; fw ctl debug -m CI + all) similiar errors are found:  

  `
  ;[DATE TIME];[vs_1];[tid_8];[fw4_8];dlpk_drv_send_buffer: called. (curr_sz=10485723, buf=0x2aaad1332260, buf_sz=124);`  
  ` 
  ;[DATE TIME];[vs_1];[tid_8];[fw4_8];dlpk_drv_send_buffer: no more free room (qid 0) watermark=10485760, curr_sz=10485723;`  
  ` 
  ;[DATE TIME];[vs_1];[tid_8];[fw4_8];dlpk_cmi_send_high_priority_buffer: dlpk_drv_send_buffer failed;`  
  ` 
  ;[DATE TIME];[vs_1];[tid_8];[fw4_8];dlpk_cmi_send_conn_info: dlpk_cmi_send_high_priority_buffer failed;`  
  ` 
  ;[DATE TIME];[vs_1];[tid_8];[fw4_8];1526495801:{module} [VSID: 00000] dlpk_cmi_AV_transfer_file_to_user_space_begin: [ERROR]: dlpk_cmi_send_conn_info failed;`  
  ` 
  ;[DATE TIME];[vs_1];[tid_8];[fw4_8];dlpk_cmi_conn_info_free: conn_id=8C39 (session_id=4ABC203) refcount is: 1;`  
  ` 
  ;[DATE TIME];[vs_1];[tid_8];[fw4_8];1526495801:{av} [VSID: 00000] ci_av_handler_upload_buffer_to_user_space: [ERROR]: failed to upload file, continue normal processing without user mode check;`  
  ` 
  ;[DATE TIME];[vs_1];[tid_8];[fw4_8];1526495801:{module} [VSID: 00000] ci_av_handler_handle_internal_file_aggregation_error: [WARNING]: about to handle internal aggregation failure (fail_reason=0);`  
  ` 
  ;[DATE TIME];[vs_1];[tid_8];[fw4_8];1526495801:{policy} [VSID: 00000] ci_get_av_sig_engine_action_by_profiles: sig_engine_action=0;`

## Cause

Emulation buffer was full.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content