Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 3 subscribers
  • Views 6924 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Autoupdate: Installation of Sophos AutoUpdate XG failed: 80004005

Florian Stöffelmayr
Sophos Anti-Virus Major Install Log_[yymmdd]_[hhmmss].txt %temp% Details the MSI actions

https://pastebin.com/vGRMW61u


2019-05-13 10:43:29 Another MSI is already running; waiting 30 seconds before retrying
=== Verbose logging started: 13.05.2019  10:43:59  Build type: SHIP UNICODE 5.00.10011.00  Calling process: C:\ProgramData\Sophos\AutoUpdate\cache\sophos_autoupdate1.dir\SophosUpdate.exe ===
MSI (c) (8C:04) [10:43:59:214]: Resetting cached policy values
MSI (c) (8C:04) [10:43:59:214]: Machine policy value 'Debug' is 0
MSI (c) (8C:04) [10:43:59:214]: ******* RunEngine:
           ******* Product: C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp\Sophos Anti-Virus.msi
           ******* Action:
           ******* CommandLine: **********
MSI (c) (8C:04) [10:43:59:214]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (8C:04) [10:43:59:214]: Grabbed execution mutex.
MSI (c) (8C:04) [10:43:59:215]: Cloaking enabled.
MSI (c) (8C:04) [10:43:59:215]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (8C:04) [10:43:59:216]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (c) (8C:04) [10:43:59:217]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
MSI (c) (8C:04) [10:43:59:217]: MainEngineThread is returning 1618
=== Verbose logging stopped: 13.05.2019  10:43:59 ===

13 10:43:59 ERROR: Installation failed

 

 

SophosUpdate.log %ProgramData\Sophos\AutoUpdate\logs Sophos AutoUpdate Install Log

https://pastebin.com/zTWEsqAu

 

2019-05-13T09:39:26.275Z [24084] [v5.14.89] INFO  Installing component E17FE03B-0501-4aaa-BC69-0129D965F311 10.8.3.322.
2019-05-13T09:39:26.287Z [24084] [v5.14.89] INFO  Checking manifest:C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp\appfeed_manifest.dat
2019-05-13T09:39:26.292Z [24084] [v5.14.89] INFO  Checking manifest:C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp\manifest.dat
2019-05-13T09:39:27.552Z [24084] [v5.14.89] INFO  Checking manifest:C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp\crt\manifest.dat
2019-05-13T09:39:27.684Z [24084] [v5.14.89] INFO  Checking manifest:C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp\SAVCFG\savcfg.manifest.dat
2019-05-13T09:39:27.689Z [24084] [v5.14.89] INFO  Checking manifest:C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp\savcontrol\savcontrol.manifest.dat
2019-05-13T09:39:27.700Z [24084] [v5.14.89] INFO  Setup path C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp\setup.dll.
2019-05-13T09:39:27.700Z [24084] [v5.14.89] INFO  Trying to load setup.dll of product E17FE03B-0501-4aaa-BC69-0129D965F311 10.8.3.322.
2019-05-13T09:39:27.712Z [24084] [v5.14.89] INFO  Setup DLL loaded C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp\setup.dll.
2019-05-13T09:39:27.712Z [24084] [v5.14.89] INFO  Trying interface IProductSetup2 of product E17FE03B-0501-4aaa-BC69-0129D965F311 10.8.3.322.
2019-05-13T09:39:27.713Z [24084] [v5.14.89] INFO  IProductSetup2 threw exception Could not create instance.
2019-05-13T09:39:27.713Z [24084] [v5.14.89] INFO  Creating CProductConfig interface.
2019-05-13T09:39:27.713Z [24084] [v5.14.89] INFO  Trying interface IProductSetup of product E17FE03B-0501-4aaa-BC69-0129D965F311 10.8.3.322.
2019-05-13T09:39:27.713Z [24084] [v5.14.89] INFO  Successfully established interface IProductSetup.
2019-05-13T09:43:59.803Z [24084] [v5.14.89] INFO  Reboot state: 0
2019-05-13T09:43:59.803Z [24084] [v5.14.89] INFO  Failed to install product E17FE03B-0501-4aaa-BC69-0129D965F311 10.8.3.322.

 

Any Idea how to resolve this properly?

 

No setupapi.app.log under \windows\inf\;

 

https://community.sophos.com/products/endpoint-security-control/f/sophos-enterprise-console/103647/savxp-update-failing  states to delete

%ProgramData%\Sophos\AutoUpdate\Cache\ folder contents, but I failed to do so (access forbidden, which service would I have to stop?)

 

 

 

 

 



This thread was automatically locked due to age.
Parents
  • 0

    Hello flo,

    error 1618 indicates that Another install is in progress, i.e. the Windows Installer is busy with an install or uninstall of some other package. The Task Manager will show two or more msiexec.exe processes (there's only one if the Installer is idle). Process Explorer can show the command line used to start a process and might help to determine which install apparently hangs. 

    Christian

  • 0 in reply to QC

    hmm

    Something strange is going on with this server.. its windows server 2016 acting as an exchange server for a company, so I cannot simply reboot it now.

    I have tried to run Process-explorer which failed. The Process is there in TaskManager, but no program window and no sysinternals acknowledge message pops up. Pslist.exe is running, though, and there I get this popup aknowledge message... I also have two sophos UI.exe, but no sophos tray icon..

    I have now killed the msiexec.exes by hand, and kicked off a sophos update manually via

    dim objALC : set objALC = CreateObject("ActiveLinkClient.ClientUpdate.1")
    objALC.UpdateNow 1,1

    lt seems to run through now, I get an Sophos Anti-Virus Major CustomActions Log, and the Sophos Anti-Virus Major Install Log is over 500kb now, all other tries were 38kb, so it definitely seems to run further

Reply
  • 0 in reply to QC

    hmm

    Something strange is going on with this server.. its windows server 2016 acting as an exchange server for a company, so I cannot simply reboot it now.

    I have tried to run Process-explorer which failed. The Process is there in TaskManager, but no program window and no sysinternals acknowledge message pops up. Pslist.exe is running, though, and there I get this popup aknowledge message... I also have two sophos UI.exe, but no sophos tray icon..

    I have now killed the msiexec.exes by hand, and kicked off a sophos update manually via

    dim objALC : set objALC = CreateObject("ActiveLinkClient.ClientUpdate.1")
    objALC.UpdateNow 1,1

    lt seems to run through now, I get an Sophos Anti-Virus Major CustomActions Log, and the Sophos Anti-Virus Major Install Log is over 500kb now, all other tries were 38kb, so it definitely seems to run further

Children
  • 0 in reply to Florian Stöffelmayr

    Sophos Anti-Virus Major Install Log now ends with

    https://pastebin.com/RqRnSbZ4

     

    Sophos Update Log:

    https://pastebin.com/fmFDtS9r

     

    so far so good; Shouldn't I get some sort of success message? the Tray icon is still not there...

    am I missing something? Sophos Central also does not seem to update its info:

     

    Anyways, Thanks for your Help, really appreciate it!

  • 0 in reply to Florian Stöffelmayr

    Hello flo,

    the SAV Major Install log should be around 3.5MB so what you pasted is definitely not the end.
    I'm not using Central which has a newer AutoUpdate with slightly changed messages but not long after the last line there should messages similar to these
    ALUpdate(Action.Success):
    SetupAction::Execute: Successfully installed Product from
    Setup action thread finished with result state 1
    SetupAction::Execute: Thread to install SAVXP returns 1
    Only then has the install completed. It might be that the install in progress was a SAVXP install that was also stuck. The last CustomAction (if this is indeed the complete installer log) seems to be SetUpdateBegin. Dunno what it's supposed to do. Guess the Major CustomActions log stops with CheckRegForNullDACLs: Action succeeded.

    The screenshot suggests the Agent hasn't been updated for quite some time, though SAVXP seems to be installed. Is there a Sophos Anti-Virus Uninstall Log from around the same time as the Major Install?

    Christian

Unfiltered HTML