Anybody come across messages like this in the update log? The internet is surprisingly unhelpful. Seems several update actions are successful - this is both an endpoint and a PureMessage/Exchange host - but then this error. It's almost as if the update processes write temporary files, but then don't have permissions to remove them ?!?!
Hello Joseph Pawlicki,
don't have permissions to remove
Access is denied suggests a permissions issue but it doesn't seem to be an attempt to remove and I'm not aware that Endpoint updating writes to %TEMP%. Anyway without context there's not much to say - could you post a larger part of the log (is it the ALUpdate log?), ideally the whole component update cycle?
Christian
Egg-zactly. It complains about permissions on these files, yet I can't even view permissions as there's no Security tab (Win2003 - WTH?). Clearly it's Sophos that's creating the files to begin with, so how can there be an access issue? Booted to safe mode so that I could remove them, but when system restarts the symptom repeats with new temp files. The internet, and so far Sophos support, have been surprisingly unhelpful, so thought I'd try here to see if others have encountered. The log sequence goes:
Time: 6/2/2016 7:48:25
Message: ERROR: the operation failed due to an unknown error: boost::filesystem::status: Access is denied: "C:\WINDOWS\Temp\LB4.tmp"
Module: ALUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:48:25
Message: Product has been successfully installed
Module: ALUpdate
Process ID: 1112
Thread ID: 2792
Time: 6/2/2016 7:47:45
Message: Installing Product Sophos PureMessage
Module: ALUpdate
Process ID: 1112
Thread ID: 2792
Time: 6/2/2016 7:47:44
Message: Installation of Sophos AutoUpdate skipped
Module: ALUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:44
Message: Installation of SAVXP skipped
Module: ALUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:44
Message: Installation of RMSNT skipped
Module: ALUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:44
Message: Downloading phase completed
Module: ALUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:44
Message: Product cache update from secondary server successfully finished
Module: ChannelUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:44
Message: Downloading product PMSR Data from server pmw-dynamic.sophos.com/.../
Module: ChannelUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Downloading product Sophos Endpoint Security and Control from server sophos
Module: SDDS2Update
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Product cache update from primary server successfully finished
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Downloading product Sophos AutoUpdate from server \\SENEGAL\SophosUpdate\CIDs\S000\SAVSCFXP\
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Product cache update from primary server successfully finished
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Downloading product SAVXP from server \\SENEGAL\SophosUpdate\CIDs\S000\SAVSCFXP\
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Product cache update from primary server successfully finished
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Downloading product RMSNT from server \\SENEGAL\SophosUpdate\CIDs\S000\SAVSCFXP\
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:33
Message: *************** Sophos AutoUpdate started ***************
Module: ALUpdate
Process ID: 1112
Thread ID: 5384
Egg-zactly. It complains about permissions on these files, yet I can't even view permissions as there's no Security tab (Win2003 - WTH?). Clearly it's Sophos that's creating the files to begin with, so how can there be an access issue? Booted to safe mode so that I could remove them, but when system restarts the symptom repeats with new temp files. The internet, and so far Sophos support, have been surprisingly unhelpful, so thought I'd try here to see if others have encountered. The log sequence goes:
Time: 6/2/2016 7:48:25
Message: ERROR: the operation failed due to an unknown error: boost::filesystem::status: Access is denied: "C:\WINDOWS\Temp\LB4.tmp"
Module: ALUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:48:25
Message: Product has been successfully installed
Module: ALUpdate
Process ID: 1112
Thread ID: 2792
Time: 6/2/2016 7:47:45
Message: Installing Product Sophos PureMessage
Module: ALUpdate
Process ID: 1112
Thread ID: 2792
Time: 6/2/2016 7:47:44
Message: Installation of Sophos AutoUpdate skipped
Module: ALUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:44
Message: Installation of SAVXP skipped
Module: ALUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:44
Message: Installation of RMSNT skipped
Module: ALUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:44
Message: Downloading phase completed
Module: ALUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:44
Message: Product cache update from secondary server successfully finished
Module: ChannelUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:44
Message: Downloading product PMSR Data from server pmw-dynamic.sophos.com/.../
Module: ChannelUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Downloading product Sophos Endpoint Security and Control from server sophos
Module: SDDS2Update
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Product cache update from primary server successfully finished
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Downloading product Sophos AutoUpdate from server \\SENEGAL\SophosUpdate\CIDs\S000\SAVSCFXP\
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Product cache update from primary server successfully finished
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Downloading product SAVXP from server \\SENEGAL\SophosUpdate\CIDs\S000\SAVSCFXP\
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Product cache update from primary server successfully finished
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:35
Message: Downloading product RMSNT from server \\SENEGAL\SophosUpdate\CIDs\S000\SAVSCFXP\
Module: CIDUpdate
Process ID: 1112
Thread ID: 5384
Time: 6/2/2016 7:47:33
Message: *************** Sophos AutoUpdate started ***************
Module: ALUpdate
Process ID: 1112
Thread ID: 5384
Hello Joseph Pawlicki,
if others have encountered
it's already obvious that I haven't [:)], the .tmp files are probably used when PM is updated.
how can there be an access issue
not impossible, several reasons (not a complete list): pending action (especially delete), file system corruption (ACL order), disk error. As you can delete them after a reboot I'd rule out the latter two. BTW - which of the Properties tabs and information can you access?
I'd suggest the following: Use Sysinternals' Process Monitor to check the operations on these files, search for existing handles with Process Explorer. As this is a PM/Exchange host you probably want to avoid reboots, but I'd also check whether a "normal" reboot releases the files and their state - i.e. verify that the Security tab is again available and inspect General Properties and Permissions. Can't say if this will explain what's going on or lead to a solution.
Christian
