This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Anti-Virus 10.8.4.227 update error unable load main virus data

Hello,

i have a problem on a windows 2012 server (lang german so translating error messages) after updating sophos anti-virus on 09/23/19.

Since then i have a notice "Sophos Device Control Service stopped" and in the SAV.txt logfile all entries since then are "Loading of main virus data not possible" (Laden der Hauptvirendaten nicht möglich). SAV-Trace.txt at this time said "2019-09-24T13:11:16.000Z [80] [11568:9592] VEManager.cpp(1442) : [8007000d] Failed to load global SXL ids", and many more after that. Eventvwr shows in about 3 second cycles SEDManager is faulty (SEDManager ist fehlerhaft), SIPSManager is faulty, SWIManager is faulty. All the messages are with event-id 13 from source Sophos Anti-Virus.

Thanks in advance.

This thread was automatically locked due to age.

0 QC over 5 years ago

Hello Dirk Jakobsmeier,

this isn't a common error. Apparently the engine initialization fails, guess the Events ID 13 are just consequential errors.

Perhaps Support can tell where or what these global SXL ids are and why they could fail to load. I'm not sure that more verbose logging would give some insight.
Reinstalling might be the quickest solution.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Dirk Jakobsmeier over 5 years ago in reply to QC

Hello Christian,

thank you for your answer. A google search did also not give me any informations on that error. So perhaps the support can help here.

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 DianneY over 5 years ago in reply to Dirk Jakobsmeier

Hello,

Run ESH (Endpoint Self-Help) to see what other services are stopped or missing.

Please have a look at this KB for further information once you have run ESH and see stopped/missing services: Sophos Endpoint Self Help: Services

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel
0 Dirk Jakobsmeier over 5 years ago in reply to DianneY

Hello DianneY,

thank you for your answer.

Looking in ESH it's only the Sophos Device Control that is stopped, in the sophos event viewer i can see that it was stopped at the time of the first not working update. As this service can be stopped temporarily this should not be a problem, is it?

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 DianneY over 5 years ago in reply to Dirk Jakobsmeier

Hello @Dirk Jakobsmeier

If there is a service missing or stopped it will indicate that the endpoint is in poor health and other components may not work properly (hence may cause the errors you are seeing in your initial post). It would be best to get all of the services started. If a service is stopped, the update on that component (or others) may have failed due to some reason.

Try the steps suggested in this KB, under "missing" or "stopped": Sophos Endpoint Self Help: Services

If not, you may find some install logs in %localappdata%\Temp or C:\Windows\Temp that pertain to Sophos, see which ones would have errors in them.

Thank You!
Cancel
Vote Up 0 Vote Down

Cancel