Sophos Enterprise Console: error a058000c, Webfiltertreiber wurde entfernt oder umgangen

If you run:

"C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_lspdiag.exe" & echo %errorlevel%

A few times on these computers, does it return 0 or 1?

The error you are getting is essentially because this test is failing and not returning 0.

I'm curious to know if this is a permanent or transient issue.  For example, if you reboot and run that command, what does it return vs after you have launched a browser process for example.

Thanks  for answer, the return is 0

Greetings Joachim

That would suggest it's intermittent as it can work.

While that is returning 0, it would suggest going to http://www.sophostest.com/phishing in a browser would also work, i.e. you would see the block page. 

Note: it has to be HTTP for the classification of that site to work.

If it is not getting 0 from time to time, that will be the issue, the interesting thing is, what triggers the state change?

If you create a batch file (testwebc.bat), for example with the following content:

:s
echo %date% %time% >> checkres.txt
"C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_lspdiag.exe" & echo %errorlevel% >> checkres.txt
timeout /t 30
goto s

Does it go from 0 to 1 at a certain time or event?  It is sampling every 30 seconds. Could be interesting to leave for a few hours and check the checkres.txt for change.

As I mentioned, you can suppress the message showing in SEC to prevent acknowledging it, you can update the ErrorAlertFilters table with the following command on the SEC server, assuming the database is local.

sqlcmd -E -S .\sophos -d SOPHOS552 -Q "INSERT INTO ErrorAlertFilters (Source, Number) VALUES ('SAV', '-1604845556')"

where I have used:

.\sophos as the SQL instance, i.e. a local SOPHOS named instance of SQL Server which is the default.

SOPHOS552 as the CORE database name which is the case for SEC 5.5.2 - see https://support.sophos.com/support/s/article/KB-000033408 

As for the Number value 0xA058000C = -1604845556 e.g.

I'd still be interested to know why the check is presumably working and then failing.  If it's working more than it's failing, etc..

If you were to move to Central as the management platform, this web protection component is about to be replaced so this is all mute

As I mentioned, you can suppress the message showing in SEC to prevent acknowledging it, you can update the ErrorAlertFilters table with the following command on the SEC server, assuming the database is local.

sqlcmd -E -S .\sophos -d SOPHOS552 -Q "INSERT INTO ErrorAlertFilters (Source, Number) VALUES ('SAV', '-1604845556')"

where I have used:

.\sophos as the SQL instance, i.e. a local SOPHOS named instance of SQL Server which is the default.

SOPHOS552 as the CORE database name which is the case for SEC 5.5.2 - see https://support.sophos.com/support/s/article/KB-000033408 

As for the Number value 0xA058000C = -1604845556 e.g.

I'd still be interested to know why the check is presumably working and then failing.  If it's working more than it's failing, etc..

If you were to move to Central as the management platform, this web protection component is about to be replaced so this is all mute