We have a strange thing going on here 00000071 ERROR: Could not find a source for updated packages

HI,

I have a few questions:

Are all those clients updating from the same server?

The same CID\Distribution point?

Is that server also the Sophos Management Server? 

How many distribution points do you have on this server, the number of Sxxx directories in the SophosUpdate share is a good indication.  

Does the SUM maintain file shares on other machines?

Are the updating policies the same for machines that are working vs those that are not and the iconn.cfg file in the config directory of AutoUpdate are the same on a working vs non working machine?

Could it be too much contention for the resource and maybe some fail to connect at times, this seems intermittent based on the logs.  This error means it failed to find any packages which suggests it almost failed to connect although I'd have thought you'd have errors to that effect to in the logs.

If you have to use a single share to service all those machines, I would suggest putting it on a dedicated file server/filer to host the CID\distribution point, maybe even putting a local SUM on the machine as the churn of SUM can be quite high if maintain a lot of subscriptions.  If they have to live on the same server as the management server, I would consider using a web share using IIS/Apache, you can then change the updating policy to reference a http update path.

Thanks,

Jak

Jak

we had the same issue. What seem to fix the problem was to push the client  again to the machine. What we noticed was that the computer details never updated from the client. It kept the old response from a while back and if you went to the computer the status would say up to date.

Good luck

Hello again,

Can we check the line in a iconn.fg file from a failing client:
\program files\sophos\AutoUpdate\Config\iconn.cfg

Or

\program data\sophos\AutoUpdate\Config\iconn.cfg (if on Vista +)

In the Primary update section it should have a line such as:

ConnectionAddress = \\[server]\SophosUpdate\CIDs\S[XXX]\SAVSCFXP\

If you check in the “Bootstrap location” menu in SEC, can you find the path and its correspond subscription is this correct? 

The S number is most important.  Does a machine in the same group and therefore have the same updating policy that is working, have exactly the same line in it?

If you check the updating policy for the group this failing machine is in, does the machine say it’’’’s complies with the updating policy and in the policy, under the "Subscription" tab is the correct subscription chosen and this shows the expected version of SAV below?

I'm starting to think this is most likely due to a mismatch of subscription ids and the clients that are failing are pointing to a S number that doesn't exist on the update location.  The client is probably pointing at the right server, but the S value is incorrect for the subscription.  The fact you have multiple SUMs makes this more likely.

Thanks

Jak

The 71 error is usually associated with a timeout condition meaning that the client did not respond to the console fast enough.

The best thing to do with this error is ask a few questions:

1) What does the client shield look like?  Have a red x or looks grey or does it look fine?

2) Check the Sophos Network Communications Report which can be found in the start menu under sophos for possible connectivity issues

3) Make sure you have at least 5 sophos services running and they are Agent, Message Router, Anti-Virus, Anti-virus Status Reporter, Auto Update.......Which should all be started.

4) Finally, understand that updating and reporting are two different things and one can work without the other working

     Meaning you can have a system that is updating but not reporting that it up to date.

5) If you have a 2008 server you may need to turn off the windows firewall service "EVEN IF" you do this with GPO it can stil be running.

Hi Guys,

first of all i wouldt like to thank you for your replys.

@ Ilene:    we pushed  the clients several times,  stil the same issues.

@ Jak       Yes  the path in the iconn.cfg  is the same  as in the in bootstrap locations  (CIDs\S014)  on 2 machines with this issue. Also in the client details pane in SEC, it states the right path.

@ Hydra  Clients are showing a RED Cross and displaying a message telling the update failed to the user

the network report   does not show any problems, all services are running

Regards,

René

Hi  again, we will crack this :)

Are you able to paste here a section of the AutoUpdate trace log, they live here:

\ProgramData\Sophos\AutoUpdate\Logs\ALUpdate[time and datestamp].log

To ensure we get just what we need, if you delete the Alupdate log files of the above name format and kick off another update on one of these failing machines, you should then get a new file generated with just the logs from that update.

Ideally if you could paste the logs from a machine in the same group that is working with a machine in the same group that isn't working I'm sure we can figure it out.

Thanks,

Jak

Hi JaK

here it is :  this one is showing  this error in the details pane

Sophos AutoUpdate status      Date/time            Code      Description                             
  10/7/2010 9:53:44 AM 00000071  ERROR: Could not find a source for updated packages

   History                                

   Sophos AutoUpdate status                                                             Date/time            Code      Description                             
   10/7/2010 9:53:44 AM 00000071  ERROR: Could not find a source for updated packages
   10/6/2010 10:17:09 AM0000006b  Download of Sophos AutoUpdate failed from server http://xxxxxx/CIDs/S014/SAVSCFXP/
 10/4/2010 11:41:52 PM00000000  Updated successfully                    
 10/4/2010 10:46:39 PM0000006b  Download of SAVXP failed from server Sophos
 10/4/2010 9:43:28 PM 00000000  Updated successfully                    
10/4/2010 8:47:12 PM 0000006b  Download of SAVXP failed from server Sophos
 10/4/2010 7:05:14 PM 00000000  Updated successfully                   
                                             10/4/2010 6:06:47 PM 00000071  ERROR: Could not find a source for updated packages
                                             10/4/2010 9:51:44 AM 00000000  Updated successfully                   
                                             10/4/2010 8:55:50 AM 0000006b  Download of Sophos AutoUpdate failed from server XXXXXXXXXXXXXXXX
                                             10/1/2010 1:15:28 PM 00000071  ERROR: Could not find a source for updated packages
                                             9/30/2010 2:24:58 PM 00000000  Updated successfully                   
                                             9/30/2010 1:25:07 PM 00000071  ERROR: Could not find a source for updated packages
                                             9/28/2010 4:44:02 PM 00000000  Updated successfully                   
                                             9/28/2010 3:44:14 PM 00000071  ERROR: Could not find a source for updated packages
                                             9/28/2010 9:45:06 AM 00000000  Updated successfully                   
                                             9/27/2010 2:24:20 PM 0000006b  Download of Sophos AutoUpdate failed from server xxxxxxxxxxxxxxxx/CIDs/S014/SA

LOG  (i deleted all old ones)

Trace(2010-Oct-08 09:50:28): ALUpdate started: -ManualUpdate  -NoGUI -RootPath "C:\Program Files\Sophos\AutoUpdate"
Trace(2010-Oct-08 09:50:28): Product iProductData.{390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92} has been added.
Trace(2010-Oct-08 09:50:28): Product iProductData.{390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92} is not  available from Sophos.
Trace(2010-Oct-08 09:50:28): Product iProductData.{390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92} is not  the Spam Rules package.
Trace(2010-Oct-08 09:50:28): Product iProductData.{D752FAB9-5883-4b36-8740-61565B6BAD29} has not been added.
Trace(2010-Oct-08 09:50:28): Product iProductData.{E17FE03B-0501-4aaa-BC69-0129D965F311} has been added.
Trace(2010-Oct-08 09:50:28): Product iProductData.{E17FE03B-0501-4aaa-BC69-0129D965F311} is  available from Sophos.
Trace(2010-Oct-08 09:50:28): Product iProductData.{E17FE03B-0501-4aaa-BC69-0129D965F311} is not  the Spam Rules package.
Trace(2010-Oct-08 09:50:28): Product subscription is disabled: iProductData.{7998C326-2CA5-4830-B7D2-B792D2460975} action value is:0
Trace(2010-Oct-08 09:50:28): Product iProductData.{7998C326-2CA5-4830-B7D2-B792D2460975} has not been added.
Trace(2010-Oct-08 09:50:28): Product iProductData.{3B758ED7-87C1-4e89-BDE1-F49DFF1249F6} has not been added.
Trace(2010-Oct-08 09:50:28): Product iProductData.{B5E7E2A7-3B64-437D-801F-21CC9D67CC6D} has been added.
Trace(2010-Oct-08 09:50:28): Product iProductData.{B5E7E2A7-3B64-437D-801F-21CC9D67CC6D} is  available from Sophos.
Trace(2010-Oct-08 09:50:28): Product iProductData.{B5E7E2A7-3B64-437D-801F-21CC9D67CC6D} is  the Spam Rules package.
Trace(2010-Oct-08 09:50:28): ConfigurationImpl, considering PMSR: PureMessage not installed, PMSR package will not be updated
Trace(2010-Oct-08 09:50:28): Considering subscribed products.
Trace(2010-Oct-08 09:50:28): Considering product {9BF40A4E-23AE-48be-9974-5A1F261DBEE8}
Trace(2010-Oct-08 09:50:28): Product {9BF40A4E-23AE-48be-9974-5A1F261DBEE8} is not already subscribed.
Trace(2010-Oct-08 09:50:28): Product {9BF40A4E-23AE-48be-9974-5A1F261DBEE8} was added to the list.
Trace(2010-Oct-08 09:50:28): Could not read registry entry containing Sophos address - using hardcoded value.
Trace(2010-Oct-08 09:50:28): Could not read registry entry containing Sophos address - using hardcoded value.
Trace(2010-Oct-08 09:50:28): IPCBase::IPCBase: Connected to shared memory A32951C539924a12B3C8F2FDA5A268E4
Trace(2010-Oct-08 09:50:28): IPCSender::ProcessSend started
Trace(2010-Oct-08 09:50:28): IPCSender::ProcessSend: No messages in queue, starting to wait
Trace(2010-Oct-08 09:50:28): RMSMessageHandler: ALUpdateStart
Trace(2010-Oct-08 09:50:28): IPCSender::Write: Writing message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSStartUpdate" />
Trace(2010-Oct-08 09:50:28): IPCSender::ProcessSend: Send message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSStartUpdate" />
Trace(2010-Oct-08 09:50:28): ALUpdate(AutoUpdate.Started):
Trace(2010-Oct-08 09:50:28): UpdateCoordinator::UpdateNow: Entering
Trace(2010-Oct-08 09:50:28): PopulateCache: Entering
Trace(2010-Oct-08 09:50:28): IPCSender::ProcessSend: No messages in queue, starting to wait
Trace(2010-Oct-08 09:50:28): UpdateCoordinator::UpdateNow: About to Sync list of products
Trace(2010-Oct-08 09:50:28): UpdateLocationFacade::SyncProduct: Last Update Mechanism = CID
Trace(2010-Oct-08 09:50:28): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Started:
Trace(2010-Oct-08 09:50:28): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, creating update location
Trace(2010-Oct-08 09:50:28): Calling package_source_init
Trace(2010-Oct-08 09:50:28): TrySyncProduct, Calling BeginSync
Trace(2010-Oct-08 09:50:29): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Calling SyncProduct with {390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92}
Trace(2010-Oct-08 09:50:29): CIDUpdateLocation::SyncProduct - Updating Product: RMSNT
Trace(2010-Oct-08 09:50:29): CIDUpdate(SyncProduct.Start): RMSNT, http://EUNL1-APS-140.europe.deleted.com/CIDs/S014/SAVSCFXP/
Trace(2010-Oct-08 09:50:29): Checksum found in master.upd matches cached cidsync.upd : 133782ac. Skipping download
Trace(2010-Oct-08 09:50:29): CIDUpdate(PrimarySuccess):
Trace(2010-Oct-08 09:50:29): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, SyncProduct returned - 1
Trace(2010-Oct-08 09:50:29): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Ended - 1
Trace(2010-Oct-08 09:50:29): UpdateLocationFacade::SyncProduct: Last Update Mechanism = CID
Trace(2010-Oct-08 09:50:29): CIDUpdateLocation::SyncProduct - Updating Product: SAVXP
Trace(2010-Oct-08 09:50:29): CIDUpdate(SyncProduct.Start): SAVXP, http://EUNL1-APS-140.europe.deleted.com/CIDs/S014/SAVSCFXP/
Trace(2010-Oct-08 09:50:29): CIDUpdateLocation::Sync - Updating from http CID: http://EUNL1-APS-140.europe.deleted.com/CIDs/S014/SAVSCFXP/savxp
Trace(2010-Oct-08 09:50:29): CIDSync(CidSyncMessage):
Trace(2010-Oct-08 09:50:30): CIDSync(CidSyncMessage): program files\Sophos\Sophos Anti-Virus\SavResCht.dll
Trace(2010-Oct-08 09:50:30): CIDSync(CidSyncMessage): program files\Sophos\Sophos Anti-Virus\Security.dll
Trace(2010-Oct-08 09:50:30): CIDSync(CidSyncMessage): fake-brm.ide

Heres a client with no errors

And heres a Client without errors 

Trace(2010-Oct-08 10:09:25): ALUpdate started: -ManualUpdate  -NoGUI -RootPath "C:\Program Files\Sophos\AutoUpdate"
Trace(2010-Oct-08 10:09:25): Product iProductData.{390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92} has been added.
Trace(2010-Oct-08 10:09:25): Product iProductData.{390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92} is not  available from Sophos.
Trace(2010-Oct-08 10:09:25): Product iProductData.{390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92} is not  the Spam Rules package.
Trace(2010-Oct-08 10:09:25): Product iProductData.{D752FAB9-5883-4b36-8740-61565B6BAD29} has not been added.
Trace(2010-Oct-08 10:09:25): Product iProductData.{E17FE03B-0501-4aaa-BC69-0129D965F311} has been added.
Trace(2010-Oct-08 10:09:25): Product iProductData.{E17FE03B-0501-4aaa-BC69-0129D965F311} is  available from Sophos.
Trace(2010-Oct-08 10:09:25): Product iProductData.{E17FE03B-0501-4aaa-BC69-0129D965F311} is not  the Spam Rules package.
Trace(2010-Oct-08 10:09:25): Product subscription is disabled: iProductData.{7998C326-2CA5-4830-B7D2-B792D2460975} action value is:0
Trace(2010-Oct-08 10:09:25): Product iProductData.{7998C326-2CA5-4830-B7D2-B792D2460975} has not been added.
Trace(2010-Oct-08 10:09:25): Product iProductData.{3B758ED7-87C1-4e89-BDE1-F49DFF1249F6} has not been added.
Trace(2010-Oct-08 10:09:25): Product iProductData.{B5E7E2A7-3B64-437D-801F-21CC9D67CC6D} has been added.
Trace(2010-Oct-08 10:09:25): Product iProductData.{B5E7E2A7-3B64-437D-801F-21CC9D67CC6D} is  available from Sophos.
Trace(2010-Oct-08 10:09:25): Product iProductData.{B5E7E2A7-3B64-437D-801F-21CC9D67CC6D} is  the Spam Rules package.
Trace(2010-Oct-08 10:09:25): ConfigurationImpl, considering PMSR: PureMessage not installed, PMSR package will not be updated
Trace(2010-Oct-08 10:09:25): Considering subscribed products.
Trace(2010-Oct-08 10:09:25): Considering product {9BF40A4E-23AE-48be-9974-5A1F261DBEE8}
Trace(2010-Oct-08 10:09:25): Product {9BF40A4E-23AE-48be-9974-5A1F261DBEE8} is not already subscribed.
Trace(2010-Oct-08 10:09:25): Product {9BF40A4E-23AE-48be-9974-5A1F261DBEE8} was added to the list.
Trace(2010-Oct-08 10:09:25): Could not read registry entry containing Sophos address - using hardcoded value.
Trace(2010-Oct-08 10:09:25): Could not read registry entry containing Sophos address - using hardcoded value.
Trace(2010-Oct-08 10:09:25): IPCBase::IPCBase: Connected to shared memory A32951C539924a12B3C8F2FDA5A268E4
Trace(2010-Oct-08 10:09:25): IPCSender::ProcessSend started
Trace(2010-Oct-08 10:09:25): IPCSender::ProcessSend: No messages in queue, starting to wait
Trace(2010-Oct-08 10:09:25): RMSMessageHandler: ALUpdateStart
Trace(2010-Oct-08 10:09:25): IPCSender::Write: Writing message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSStartUpdate" />
Trace(2010-Oct-08 10:09:25): IPCSender::ProcessSend: Send message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSStartUpdate" />
Trace(2010-Oct-08 10:09:25): IPCSender::ProcessSend: No messages in queue, starting to wait
Trace(2010-Oct-08 10:09:25): ALUpdate(AutoUpdate.Started):
Trace(2010-Oct-08 10:09:25): UpdateCoordinator::UpdateNow: Entering
Trace(2010-Oct-08 10:09:25): PopulateCache: Entering
Trace(2010-Oct-08 10:09:25): UpdateCoordinator::UpdateNow: About to Sync list of products
Trace(2010-Oct-08 10:09:25): UpdateLocationFacade::SyncProduct: Last Update Mechanism = CID
Trace(2010-Oct-08 10:09:25): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Started:
Trace(2010-Oct-08 10:09:25): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, creating update location
Trace(2010-Oct-08 10:09:25): Calling package_source_init
Trace(2010-Oct-08 10:09:25): TrySyncProduct, Calling BeginSync
Trace(2010-Oct-08 10:09:26): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Calling SyncProduct with {390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92}
Trace(2010-Oct-08 10:09:26): CIDUpdateLocation::SyncProduct - Updating Product: RMSNT
Trace(2010-Oct-08 10:09:26): CIDUpdate(SyncProduct.Start): RMSNT, http://EUNL1-APS-140.europe.DELETED.com/CIDs/S014/SAVSCFXP/
Trace(2010-Oct-08 10:09:26): Checksum found in master.upd matches cached cidsync.upd : 133782ac. Skipping download
Trace(2010-Oct-08 10:09:26): CIDUpdate(PrimarySuccess):
Trace(2010-Oct-08 10:09:26): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, SyncProduct returned - 1
Trace(2010-Oct-08 10:09:26): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Ended - 1
Trace(2010-Oct-08 10:09:26): UpdateLocationFacade::SyncProduct: Last Update Mechanism = CID
Trace(2010-Oct-08 10:09:26): CIDUpdateLocation::SyncProduct - Updating Product: SAVXP
Trace(2010-Oct-08 10:09:26): CIDUpdate(SyncProduct.Start): SAVXP, http://EUNL1-APS-140.europe.DELETED.com/CIDs/S014/SAVSCFXP/
Trace(2010-Oct-08 10:09:26): Checksum found in master.upd matches cached cidsync.upd : c55d72a8. Skipping download
Trace(2010-Oct-08 10:09:26): CIDUpdate(PrimarySuccess):
Trace(2010-Oct-08 10:09:27): UpdateLocationFacade::SyncProduct: Last Update Mechanism = CID
Trace(2010-Oct-08 10:09:27): CIDUpdateLocation::SyncProduct - Updating Product: Sophos AutoUpdate
Trace(2010-Oct-08 10:09:27): CIDUpdate(SyncProduct.Start): Sophos AutoUpdate, http://EUNL1-APS-140.europe.DELETED.com/CIDs/S014/SAVSCFXP/
Trace(2010-Oct-08 10:09:27): Checksum found in master.upd matches cached cidsync.upd : 2443b62e. Skipping download
Trace(2010-Oct-08 10:09:27): CIDUpdate(PrimarySuccess):
Trace(2010-Oct-08 10:09:28): ALUpdate(DownloadEnded):
Trace(2010-Oct-08 10:09:28): UpdateCoordinator::UpdateNow: About to Action list of products
Trace(2010-Oct-08 10:09:28): ALUpdate(Action.Skipped): RMSNT
Trace(2010-Oct-08 10:09:28): ALUpdate(Action.Skipped): SAVXP
Trace(2010-Oct-08 10:09:28): ALUpdate(Action.Skipped): Sophos AutoUpdate
Trace(2010-Oct-08 10:09:29): RMSMessageHandler: ALUpdateEnd
Trace(2010-Oct-08 10:09:29): Sending message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSEndUpdate" />
Trace(2010-Oct-08 10:09:29): IPCSender::Write: Writing message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSEndUpdate" />

Thanks for the logs, did the failing log get cut short by the limitation of the forum message size?

It's seems odd that it finished with reference to an ide.

Thanks

Jak