This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

e03d0056

I am getting this error code: e03d0056 using Sophos Enterprise Console version 5.4.0 on a few of our Sophos managed computers. I ask this because when I click on the corresponding link under the Computer Details screen, I get this: Your search - sav - e03d0056 site:www.sophos.com/en-US/support/knowledgebase - did not match any documents. No pages were found containing "sav - e03d0056 site:www.sophos.com/en-US/support/knowledgebase". Under the Scanning errors column, it shows, "; The on-access driver failed to determine the name for a file. [0xe03d0056]". What I am hoping for is information that provides: where to look, what it is, what could be causing it, the importance, or a possible solution.

This thread was automatically locked due to age.

Parents

0 QC over 8 years ago

Hello TedMoyers,

please see the Scanning error message thread.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 logan williams over 7 years ago in reply to QC

Christian,

I have looked at the other post and don't see the correlation. I'm having this pop up on around 60 machines and I'm just trying to tidy up our console. Can you elaborate on how we resolve this?

Thanks,

Logan
Cancel
Vote Up 0 Vote Down

Cancel
0 Teri Grinnell over 7 years ago in reply to logan williams

Same here. How do I resolve this?
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 7 years ago in reply to Teri Grinnell

The on-access driver failed to determine the name for a file. [e03d0056] seems of little use.

I would suggest to suppress it: e03d0056 as a 32-bit signed dec is: -532873130.

PS C:\> [int]::Parse('e03d0056',"HexNumber")
-532873130

There is a table in the 'core' database called: "ErrorAlertFilters"; you could try using this to filter it out in the future, for example the command (admin prompt):

sqlcmd -E -S .\sophos -d SOPHOS550 -Q "INSERT INTO ErrorAlertFilters (Source, Number) VALUES ('SAV', '-532873130') "

I have assumed a default local Sophos instance (.\sophos) is being used and SEC 5.5, hence the SOPHOS550 database name.
For more details on the database name see: https://community.sophos.com/kb/en-us/17323
For locating the instance of SQL in use by SEC see: https://community.sophos.com/kb/en-us/113030

This will prevent the "SAV" message being displayed in SEC in the future if you acknowledge the current ones.

Hopefully that helps.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Wallsy over 7 years ago in reply to Teri Grinnell

Same Here
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Wallsy over 7 years ago in reply to Teri Grinnell

Same Here
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Polygon-tre over 7 years ago in reply to Wallsy

Hello,

I further investigated this often happening alerts on Sophos Enterprise Console for Anti Virus.

It seems to me this can be reproduced when a user tries to click on a windows .lnk file that refers to an unavailable network drive location (e.g. network drive no longer mapped).

I then noticed, right clicking this "dead link" .lnk file and choosing "Scan with Sophos Anti Virus" ends in an "Unknown Error".

This should be fixed by sophos after investigation if its really a bug.

Thanks and kind regards
Cancel
Vote Up 0 Vote Down

Cancel
0 Wallsy over 6 years ago in reply to Polygon-tre

I will give this a go and see if I can replicate you are seeing, Sophos have not been the best with this one.
Cancel
Vote Up 0 Vote Down

Cancel
0 Navar Holmes over 6 years ago in reply to Wallsy

This error is not random for one of our laptops running Windows 10 and the preview version of endpoint.

Open SEC acknowledge this error and any others(e03d000f and a05800c) reboot the laptop and before I can login error e03d0056 is back followed by e03d00f and then a05800c.

I am really starting to think it is normal for sophos end point to be polluted with random errors.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to Navar Holmes

Hello Navar Holmes,

these errors aren't normal.
Apparently they can be "reliably reproduced". I'd open a ticket with Support as it should be possible to get closer to the actual cause but this requires some specific tracing.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Wallsy over 6 years ago in reply to QC

I have opened a ticket with support, and they are telling me to supress it, after many months of more logs and trying different things, I'm not sure that supressing the error, is the smartest thing to do. but I'm spending so much time on this, it needs to end, I'm being to told that the error cant be reproduced and it is transient, so supressing it is the way to go.
Cancel
Vote Up 0 Vote Down

Cancel