Sophos EndUser Protection

[kmd]

Hi

I have installed Sohpos Update manager on a good few of our sites and all is working okay.I was installing the update manager directly from the server where Enterprise Console is set up.Then it would download all the binaries, seems to copy over around 300mb or there abouts.

Just wondering If I needed to set up Sophos Update Manager on some of our locations, which have satellite links, is there any way around having all this data copied over the satellite link the first time.

I was thinking of copying the install files from main server to cd, and then copying Update folder from another Update Manger onto cd, then installing update manager.

In the hope then that when it updates the next time, it will already have bulk of data so would need a large copy the first time

Any thought, or has anyone done this before

Thanks

[QC]

Hello kmd,

[Heaven forbid that I've also to del with satellite links].

You can copy the SUMInstallset contents to a CD/DVD and install from there. Afterwards the secondary SUM has to talk to the central console to get its configuration. You probably want to "bootstrap" the warehouse data. I have an idea but I'd like to check it out - which will, due to our National Holiday, not be before Wednesday. 

Christian

[QC]

Follow up as promised

The following procedure seems to work:

• Copy the SUMInstaller (shared as SUMInstallSet) and the Update Manager\Warehouse folder (from the SophosUpdate share) to CD/DVD (or a USB stick). I assume that you put SUMInstaller directly under the root and Warehouse under Updates.
• Get the medium to the remote machine (let's call it R-SUM) and install SUM. Also share the Updates folder (I assume as \\R-SUM\Updates).
• After installation R-SUM will appear in SEC's Update Managers view. Use View/Edit configuration, tab Sources -> Add and enter \\R-SUM\Updates as Address (ignore the warning about the missing credentials), select the appropriate Subscription and save the configuration.
• Use Update now to force the initial "download" a creation of the CID(s). If you want to act R-SUM also as message relay configure the CID accordingly. Create an updating policy which uses R-SUM, apply this policy to R-SUM and protect it. You should then see R-SUM as protected but out of date, the timestamp should be from around the time you copied the Warehouse. 
• Next View/Edit configuration and configure the "live" update source (you can keep the local share from the CD but move it down the list). With the next update (scheduled or forced) R-SUM will fetch the delta which should be significantly less. To verify it worked check the Endpoint view where R-SUM should be (more or less) up to date then (after a short delay of course depending on the schedules).

I did not simulate the latency and bandwidth of a satellite link but it should not matter. Well, if you try please tell us about it.

Christian

[kmd]

Cheers QC for that, will give it a go during the next week

And let you know how it goes

Thanks

KMD

[kmd]

Hi Qc

I followed the steps and all seemed to be working fine. Updated from local source and then changed update location to our main update server. Now when it tries to update, getting the following errors

  04/11/2010 11:28:44  80040404  Threat detection data update failed.   
                                             04/11/2010 11:28:37  80040408  Unable to write to distribution location \\serrvername\sophosupdatefor software subscription 'Recommended'.
                                             04/11/2010 11:02:37  80040401  Software update failed.              

Permissions on the share are the same as all other update manager servers

any other ideas

THanks

KMD  

[QC]

Hello KMD,

no pain, no gain . Indexing service or something like it are usual suspects but it on the rare occasions I've encountered a similar error they weren't involved

Just deleting all and everything (CIDs and Warehouse) would foil your efforts, but emptying only the affected CID (you don't have ESCOSX, do you?) might be sufficient and shouldn't result in a complete download, SUM will only re-decode the files. Before doing that you should check the SUMTrace logs for lines containing boost::. The preceding or following line usually tells you for which file and CID the error occurred.

Christian

[kmd]

Hi QC

Done a search through the sumtrace log file and got a lot of entries for boost, all had  F26F7EC0-1302-4DA7-8B6B-A5383051D41A in the same line, so deleted this from the folder, and then tried the update. Still same issue and that folder seems to get created again and same error then in the next log file

Thanks for your help so far

any other idea's or is my only option to delete everything in cid and warehouse folder?

[QC]

Hello again,

could you post a few of the lines? And did you search for boost:: (with two colons) - just asking cause I haven't seen the F26F7EC0... (whcih is SAVSCFXP btw) on the same line as the error. It's probably better to search for boost::filesystem.

Here's an example:

2009-11-16 16:28:23 : CID Deploy C:\Documents and Settings\All Users\Application Data\Sophos\Update Manager\Working\.\Decoded-Sub0\1F46AC1D-7094-4675-8DDE-5C63197849D8\agen-lri.ide to C:\Documents and Settings\All Users\Application Data\Sophos\Update Manager\Update Manager\CIDs\S049\unixinst\aix\powerpc\agen-lri.ide
2009-11-16 16:28:23 : Cmd-ALL << [E4037][boost::filesystem::copy_file] Deployment to a share failed because of an unexpected error. Details: boost::filesystem::copy_file

Christian

[kmd]

Hi Christian

Here is some samples of the log file

2010-11-04 14:00:39 : CID Deploy C:\Program Files\Sophos\Update Manager\cac.pem to C:\Documents and Settings\All Users.WINNT\Application Data\Sophos\Update Manager\Update Manager\CIDs\S000\SAVSCFXP\cac.pem
2010-11-04 14:00:39 : Cmd-ALL << [E4023][C:\Documents and Settings\All Users.WINNT\Application Data\Sophos\Update Manager\Update Manager\CIDs\S000][SAVSCFXP][F26F7EC0-1302-4DA7-8B6B-A5383051D41A][RECOMMENDED][boost::filesystem::remove] The deployment to share 'C:\Documents and Settings\All Users.WINNT\Application Data\Sophos\Update Manager\Update Manager\CIDs\S000' failed to copy the RMS config files with the error: boost::filesystem::remove

2010-11-04 14:01:31 : Cmd-ALL << [E4023][C:\Documents and Settings\All Users.WINNT\Application Data\Sophos\Update Manager\Update Manager\CIDs\S000][SAVSCFXP][F26F7EC0-1302-4DA7-8B6B-A5383051D41A][RECOMMENDED][boost::filesystem::remove] The deployment to share 'C:\Documents and Settings\All Users.WINNT\Application Data\Sophos\Update Manager\Update Manager\CIDs\S000' failed to copy the RMS config files with the error: boost::filesystem::remove
2010-11-04 14:01:31 : Cmd-ALL << [E400D][ActionDeployCids-Sub0-0][DispatcherSupplements-2010-11-04T13-57-57-21] Action 'ActionDeployCids-Sub0-0' with caller 'DispatcherSupplements-2010-11-04T13-57-57-21' failed!
2010-11-04 14:01:31 : Cmd-ALL << [I1021][ActionDecodeEverything-SDDM][DispatcherPrograms-2010-11-04T13-55-39-10] Action 'ActionDecodeEverything-SDDM' with caller 'DispatcherPrograms-2010-11-04T13-55-39-10' started...
2010-11-04 14:01:33 : Cmd-ALL << [S001A][C:\Documents and Settings\All Users.WINNT\Application Data\Sophos\Update Manager\Working\.\Decoded-SDDM\A845A8B5-6532-4EF1-B19E-1DB2B3CB73D1][sum][A845A8B5-6532-4EF1-B19E-1DB2B3CB73D1][RECOMMENDED] The decode operation was successful (and NULL).
2010-11-04 14:01:33 : Cmd-ALL << [S0013][C:\Documents and Settings

2010-11-04 14:09:24 : Cmd-ALL << [E4023][C:\Documents and Settings\All Users.WINNT\Application Data\Sophos\Update Manager\Update Manager\CIDs\S000][SAVSCFXP][F26F7EC0-1302-4DA7-8B6B-A5383051D41A][RECOMMENDED][boost::filesystem::remove] The deployment to share 'C:\Documents and Settings\All Users.WINNT\Application Data\Sophos\Update Manager\Update Manager\CIDs\S000' failed to copy the RMS config files with the error: boost::filesystem::remove
2010-11-04 14:09:24 : Cmd-ALL << [E400D][ActionDeployCids-Sub0-0][DispatcherSupplements-2010-11-04T14-07-57-22] Action 'ActionDeployCids-Sub0-0' with caller 'DispatcherSupplements-2010-11-04T14-07-57-22' failed!
2010-11-04 14:09:24 : Cmd-ALL << [I1021][Act

[QC]

Ok, I can't delete the files from the S000\SAVSCFXP folder. Can you delete them manually?