Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 13 replies
  • Subscribers 1 subscriber
  • Views 3611 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Updates Warning in Console (v4.5)

SophosAV

Console Warning

Hi All,

This isn't a show stopper or anything, more aesthetic, but I would like jto resolve it if possible.  My console and clients are all up to date but I still see the above warning in my console.  Maybe there's an XML file somewhere that needs changing?  Any help appreciated.

Thanks,

SophosAV

:11857


This thread was automatically locked due to age.
  • 0

    Hello SophosAV,

    looks fairly recent but you should also have told us your current time :smileywink:. Usually this is a correct indicator for a (perhaps transient) update error. If it persists you should view the update manager's details.

    Christian

    :11875
  • 0

    HI,

    Looking at a SQL Profiler trace of what's going on, the dasboard data is fetched using the strored procedure:

    dbo.ComputerDashboardDataGet

    Depending on which subestate the data is being called for, it goes on to call either:

    dbo.ComputerDashboardDataGetAll
    or
    dbo.ComputerDashboardDataGetSE


    These essentially takes the subestate as a parameter and 2 time stamps.

    The part of the query that fetches that update time is something like:

    SELECT MAX(LastBinaryUpdate) AS FreshestSUMUpdate, ISNULL(MIN(LastBinaryUpdate), 0) AS StalestSUMUpdate
			FROM dbo.SDDMServers WITH (NOLOCK)
			WHERE ComputerID IN (SELECT ID FROM dbo.AliveComputersInSubestate( 1 ) WHERE Managed=1)
			AND LastBinaryUpdate != 0

    I have added the 1 in the call to 

    AliveComputersInSubestate

     to represent the default subestate.

    So essentially it's the oldest time of the column lastbinaryupdate in the table dbo.sddmservers.

    This suggest that one of your SUMs hasn't updated or hasn't sent in a status message to report an update for a while.  Is there a SUM with the same "Last Updated" time?  

    If you run:

    sqlcmd -E -S .\sophos -d sophos45 -Q "select c.Name, c.LastMessageTime StatusRefreshedAt, LastBinaryUpdate, LastDataUpdate from dbo.SDDMServers as s left join dbo.ComputersAndDeletedComputers as c on c.ID = s.ComputerID" -o C:\windows\temp\out.txt -w 1000

     Which SUM has the same time as displayed in the dashboard?  Just considering the minutes and seconds should be enough if the timezones make the hours off.

    I would suggest on that SUM machine:
    1. Stop the SUM Service
    2. Stop the Sophos Agent service.
    3. Start the SUM Service

    4. Start the Agent Service.
    5. In SEC, check the computer details page of that SUM machine (endpoints view) and look at the last message time.  It should be very recent.


    I would then force the SUM to update and then re-query the table after it completes its update routine.

    Hope this helps.

    Regards,

    Jak

    :11877
  • 0

    Hi QC and Jak,

    Sorry for the late reply guys, I had some time off work last week, and being quite sad I'm checking the forums over the weekend before I go back...

    That's an impressive investigative reply there Jak and very much appreciated.  I will run through your suggestion first tihng on Monday and mark your reply as the solution if it all works out ;)

    Thanks again,

    SophosAV

    :12041
  • 0

    Hi Jak,

    I have run your (extremely good) TSQL and have noted the time is one hour behind in each of the columns compared with the local machine time and the Sophos console.  Unfortunately a restart of the Agent and SUM services hasn't fixed the issue so I'm assuming there is a time issue on my SQL server.   The Windows server time locally on all servers involved looks fine, but for some reason the time entered into each column in SQL is 60mins out. 

    I can see this is probably going to be a SQL issue, but If anyone has seen this before, I would be most grateful for any advice.

    Thanks,

    SophosAV

    :12083
  • 0

    HI,

    The times stored in the database are all in UTC, that way, depending on the timezone SEC is running in the local time can be displayed.

    Jak

    :12087
  • 0

    The times stored in the database are all in UTC

    Right, and the displayed time is adjusted to the time and timezone used on the computer running the console GUI. Thinking about it - this does not explain the exclamation mark though. And in case of a warning I would have expected the text Last successful update ....

    Any errors reported in the Update managers view?

    Christian

    :12115
  • 0

    Hi QC & Jak,

    Thanks again for the replies.

    The console server is set to (GMT) Dublin, Edinburgh, Lisbon, London and the tables are as you say in UTC and showing correctly.  I have checked with the SQL guys and all looks good from that side, so could just be a bug somewhere?  There are no errors in the SUM view (see attached screenshot) and everything seems to work just fine ;) 

    Thanks,

    SophosAV

    SUM Console

    :12181
  • 0

    Wild guess ... open Tools -> Configure Dashboard ... bottom right: Latest protection from Sophos. Check if changing the default values makes a difference.

    Christian

    :12183
  • 0

    Hi,

    Did you ever have EMibrary?  

    Is there anything in the table: 

    EMLibraryServers?

    Regards

    Jak

    :12217
  • 0

    Hi QC & Jak,

    I checked the Dashboard Configuration and changed the default values but this hasn't updated the Critial alert.

    I did used to have EMLibrary installed on my old server and had some initial issues getting SUM to work after moving to the new server and upgrading to 4.5.   There is an entry in the EMLibraryServers table (see below)

    EMLibraryServers

    Shall I delete this entry?  I guess there will be other table dependencies that will prevent me from doing so though...

    Thanks,

    SophosAV

    :12229
Unfiltered HTML