This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Installer: download error from dci.sophosupd.com - non existing host

LHerzog 10 months ago

We're trying to install a new Agent and are getting trouble:

Error fetching data from https://dci.sophosupd.net/update/4/1a/41aea06e7cf0d70e17fc260874fb911c.dat

That host cannot be resolved. No DNS entires!

That will be a global problem.

Installer Version 1.19.68.0 (downloaded only minutes ago)

Can we bypass this? How can we install new Clients?

*** Keine internal type for both IPv4 and IPv6 Addresses (A+AAAA)-Einträge für dci.sophosupd.com verfü
> dci.sophosupd.com 8.8.8.8
Server: [8.8.8.8]
Address: 8.8.8.8

Name:    dci.sophosupd.com

> set type=all
> dci.sophosupd.com 8.8.8.8
Server: [8.8.8.8]
Address: 8.8.8.8

sophosupd.com
        primary name server = asia1.akam.net
        responsible mail addr = hostmaster.sophos.com
        serial = 2020011375
        refresh = 7200 (2 hours)
        retry   = 3600 (1 hour)
        expire = 604800 (7 days)
        default TTL = 3600 (1 hour)
>

2024-02-19T10:24:35.4429446Z INFO : Certificate check succeeded
2024-02-19T10:24:35.4439442Z INFO : ValidateFileCertificateCheck: Ignore WINHTTP_CALLBACK_STATUS_REQUEST_SENT
2024-02-19T10:24:35.4586599Z INFO : Response status code: 200
2024-02-19T10:24:35.4586599Z INFO : Response data size: 0
2024-02-19T10:24:35.4586599Z INFO : Sending HTTP 'GET' request to: sophos/management/ep/install/policy/application/ALC/27c2364733090e8312f5e417de71339b00fb89d5c74e5238005aebd448287c24
2024-02-19T10:24:35.4596672Z INFO : Request content size: 0
2024-02-19T10:24:35.4596672Z INFO : ValidateFileCertificateCheck: Validate certificate against file on WINHTTP_CALLBACK_STATUS_SENDING_REQUEST
2024-02-19T10:24:35.4606670Z INFO : Subject certificate failed validation against root CA: SophosCA1
2024-02-19T10:24:35.4616660Z INFO : Subject certificate failed validation against root CA: SophosCA2
2024-02-19T10:24:35.4636649Z INFO : Certificate check succeeded
2024-02-19T10:24:35.4636649Z INFO : ValidateFileCertificateCheck: Ignore WINHTTP_CALLBACK_STATUS_REQUEST_SENT
2024-02-19T10:24:35.5265216Z INFO : Response status code: 200
2024-02-19T10:24:35.5275314Z INFO : Response data size: 3658
2024-02-19T10:24:35.5275314Z INFO : Assume obfuscated SAU password
2024-02-19T10:24:35.6225282Z INFO : Subscription id: Base, rigidname: WindowsCloudNextGen, baseversion: 11, tag: RECOMMENDED, fixedversion: 
2024-02-19T10:24:35.6225282Z INFO : Subscription id: Clean, rigidname: WindowsCloudClean, baseversion: 1, tag: RECOMMENDED, fixedversion: 
2024-02-19T10:24:35.6225282Z INFO : Subscription id: CloudAV, rigidname: WindowsCloudAV, baseversion: 11, tag: RECOMMENDED, fixedversion: 
2024-02-19T10:24:35.6225282Z INFO : Subscription id: Encryption, rigidname: WindowsCloudEncryption, baseversion: 1, tag: RECOMMENDED, fixedversion: 
2024-02-19T10:24:35.6225282Z INFO : Subscription id: HitmanProAlert, rigidname: WindowsCloudHitmanProAlert, baseversion: 1, tag: RECOMMENDED, fixedversion: 
2024-02-19T10:24:35.6225282Z INFO : Subscription id: MDR, rigidname: WindowsCloudMDR, baseversion: , tag: RECOMMENDED, fixedversion: 
2024-02-19T10:24:35.6225282Z INFO : Fixed version token is not used
2024-02-19T10:24:35.6225282Z INFO : Feature: APPCNTRL
2024-02-19T10:24:35.6225282Z INFO : Feature: AV
2024-02-19T10:24:35.6225282Z INFO : Feature: CLEAN
2024-02-19T10:24:35.6225282Z INFO : Feature: CORE
2024-02-19T10:24:35.6225282Z INFO : Feature: DLP
2024-02-19T10:24:35.6225282Z INFO : Feature: DVCCNTRL
2024-02-19T10:24:35.6225282Z INFO : Feature: EFW
2024-02-19T10:24:35.6225282Z INFO : Feature: HBT
2024-02-19T10:24:35.6225282Z INFO : Feature: LIVEQUERY
2024-02-19T10:24:35.6225282Z INFO : Feature: LIVETERMINAL
2024-02-19T10:24:35.6225282Z INFO : Feature: MDR
2024-02-19T10:24:35.6225282Z INFO : Feature: NTP
2024-02-19T10:24:35.6225282Z INFO : Feature: SAV
2024-02-19T10:24:35.6235284Z INFO : Feature: SDU
2024-02-19T10:24:35.6235284Z INFO : Feature: WEBCNTRL
2024-02-19T10:24:35.6235284Z INFO : Feature: XPD
2024-02-19T10:24:35.6235284Z INFO : Setting https download to: true
2024-02-19T10:24:35.6235284Z INFO : Updating  credentials created with username: PRD8L73E4H
2024-02-19T10:24:35.6235284Z INFO : Server for 'sus': sus.sophosupd.com
2024-02-19T10:24:35.6235284Z INFO : Server for 'content_server': sdds3.sophosupd.com
2024-02-19T10:24:35.6235284Z INFO : Server for 'content_server': sdds3.sophosupd.net
2024-02-19T10:24:35.6235284Z INFO : Server for 'telemetry': t1.sophosupd.com
2024-02-19T10:24:35.6235284Z INFO : Server for 'feedback': sdu-feedback.sophos.com
2024-02-19T10:24:35.6235284Z INFO : Server for 'repairkit': sdu-auto-upload.sophosupd.com
2024-02-19T10:24:35.6235284Z INFO : Restarting MCS Client service if stopped
2024-02-19T10:24:35.6235284Z INFO : Command 'Register' completed with success with reboot code '0' and error message ''.
2024-02-19T10:24:35.6235284Z INFO : About to execute command: Download
2024-02-19T10:24:35.6365288Z INFO : Update Cache Cert Path folder: C:\\ProgramData\\Sophos\\Certificates\\AutoUpdate\\Cache
2024-02-19T10:24:35.6365288Z INFO : No update caches configured
2024-02-19T10:24:35.6365288Z INFO : Updating from Sophos
2024-02-19T10:24:35.6380667Z INFO : Did not discover an URL for a PAC file
2024-02-19T10:24:35.6380667Z INFO : Updating configured to use: HTTPS
2024-02-19T10:24:35.6380667Z INFO : Initial download: attempting to use bulk metadata
2024-02-19T10:24:35.6380667Z INFO : Entered Sdds2DownloaderImpl::setGlobalFilter
2024-02-19T10:24:35.6380667Z INFO : Using platform ID WIN_10_X64
2024-02-19T10:24:35.6380667Z INFO : Subscription: Base
2024-02-19T10:24:35.6380667Z INFO : SUL info: [V46381] SU::Handle::readRemoteMetadata + SU::Handle::readRemoteMetadata()
2024-02-19T10:24:35.6380667Z INFO : SUL info: [V75884] SU::Metadata::readRemoteMetadata SU::Metadata::readRemoteMetadata()
2024-02-19T10:24:35.6380667Z INFO : SUL info: [I40394] Downloading customer file from sophos:1:1
2024-02-19T10:24:35.6380667Z INFO : SUL info: [V81533] SU::createCachedPackageSource about to create cached package source for sophos:1:1, url=sophos
2024-02-19T10:24:35.6380667Z INFO : SUL info: [V81533] SU::createCachedPackageSource creating root package source for location: sophos:1:http://dci.sophosupd.com/update, path: 4/1a/41aea06e7cf0d70e17fc260874fb911c.dat
2024-02-19T10:24:36.4140741Z WARNING : SUL error: [E26245] Error fetching data from http://dci.sophosupd.com/update/4/1a/41aea06e7cf0d70e17fc260874fb911c.dat: WinHttpSendRequest (error 12007)
2024-02-19T10:24:36.4150719Z INFO : SUL info: [I26245] No proxy was used.
2024-02-19T10:24:36.4150719Z INFO : SUL info: [I40394] Downloading customer file from sophos:2:1
2024-02-19T10:24:36.4150719Z INFO : SUL info: [V81533] SU::createCachedPackageSource about to create cached package source for sophos:2:1, url=sophos
2024-02-19T10:24:36.4150719Z INFO : SUL info: [V81533] SU::createCachedPackageSource creating root package source for location: sophos:1:http://dci.sophosupd.net/update, path: 4/1a/41aea06e7cf0d70e17fc260874fb911c.dat
2024-02-19T10:24:37.1977912Z WARNING : SUL error: [E26245] Error fetching data from http://dci.sophosupd.net/update/4/1a/41aea06e7cf0d70e17fc260874fb911c.dat: WinHttpSendRequest (error 12007)
2024-02-19T10:24:37.1977912Z INFO : SUL info: [I26245] No proxy was used.
2024-02-19T10:24:37.1988546Z INFO : SUL info: [I40394] Downloading customer file from sophos:3:1
2024-02-19T10:24:37.1988546Z INFO : SUL info: [V81533] SU::createCachedPackageSource about to create cached package source for sophos:3:1, url=sophos
2024-02-19T10:24:37.1988546Z WARNING : SUL error: [E75373] Ran out of sophos aliases for this update source
2024-02-19T10:24:37.1988546Z WARNING : SUL error: [E35369] Out of update sources
2024-02-19T10:24:37.1988546Z WARNING : SUL error: [E99999] Out of sources
2024-02-19T10:24:37.1998488Z ERROR : DownloadCommand::onRun() failed with std::exception: MetaDataScope::MetaDataScope failed with error code 4
2024-02-19T10:24:37.2008629Z INFO : Command 'Download' completed with failure with reboot code '0' and error message 'Software konnte nicht heruntergeladen werden'.
2024-02-19T10:24:37.2008629Z ERROR : Installation failed.
2024-02-19T10:24:37.2008629Z INFO : Sending HTTP 'POST' request to: sophos/management/ep/install/events/endpoint/3e74c544-92ca-6492-8bff-ff527779ffe7
2024-02-19T10:24:37.2038052Z INFO : Did not discover an URL for a PAC file
2024-02-19T10:24:37.2038052Z INFO : Attempting to connect using proxy '' of type 'Empty Proxy'.
2024-02-19T10:24:37.2048021Z INFO : Set security protocol: 00000800

This thread was automatically locked due to age.

0 LHerzog 10 months ago

looks like it used to be prod-san-1-dd.sophosdelivery.edgekey.net

now it's empty.

Recommendations are highly appreciated.

Interesting that there are no more "me too" reports here?

MetaDataScope::MetaDataScope failed with error code 4
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog 10 months ago in reply to LHerzog

it's working now

something on the cloud service must have changed. The install log looks different from the log line named "Update Cache Cert Path folder"
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog 10 months ago in reply to LHerzog

today we found more computers we installed a few days ago - they are not authenticating against our firewall and do not appear in Sophos Central. Though they are tamper protected.

We disable tamper by following: support.sophos.com/.../KB-000036125

Those machines are then treated with sophos zap tool 2 times an then we can reinstall Sophos EP.

During EP reinstallation the computers are added to Central now but they cannot download from dci.

We run zap tool again 2 times and then it seems to work and it can register and download packages.

What's going on?
Cancel
Vote Up 0 Vote Down

Cancel
0 Qoosh 10 months ago in reply to LHerzog

I suspect this has to do with the decommissioning of SDDS2 updating servers. Could you check the following registry key on any affected devices you find?

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\AutoUpdate\UpdateStatus

The "sddsVersion" should have an argument of 3.

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog 10 months ago in reply to Qoosh

that change was years ago, correct? the computers were bought and installed a week ago
Cancel
Vote Up 0 Vote Down

Cancel
0 Yogalakshmi 10 months ago in reply to LHerzog
Hi LHerzog,

Good day.

On the 28th of January 2024, the certificate used by our previous SDDS2 updating mechanism expires, resulting in failing any device attempting to update using SDDS2. For more information, click here. So it's suggested to check the registry value once.

Open Regedit, and go to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\AutoUpdate\UpdateStatus\

check if the value of sddsVersion is 3.
Yogalakshmi
Sophos Digital Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog 10 months ago in reply to Yogalakshmi
hi Yogalakshmi and thanks for that KB.

Sophos Central customers who were protected but have not restarted their devices since the migration process completed:

Windows Endpoints: 09th August 2022

Windows Servers: 23rd August 2022

with that info, we're out. We'll check the key at next occourrence anyway.
Cancel
Vote Up 0 Vote Down

Cancel
0 Qoosh 10 months ago in reply to LHerzog

If the url "dci.sophosupd.com" is referenced, this will indicate that the device is still trying SDDS2, whereas an SDDS3 URL will look like "sdds3.sophosupd.com".

Can you confirm that a new installer package is also being used?

If you suspect you can replicate this issue again, could you kindly gather a procmon log while the installation takes place, followed by an SDU log?

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog 10 months ago in reply to Qoosh

I do:
Cancel
Vote Up -1 Vote Down

Cancel
0 LHerzog 9 months ago in reply to LHerzog

the reg key is sdds3

that machine has the issue
Cancel
Vote Up 0 Vote Down

Cancel