Updating Policy is not working for Linux

Question

Hi, 
 I have been searching for an answer on this for about an hour, but am guessing someone will respond with a link to the KB on this. 
 I installed the endpoint agent on an Ubuntu Linux system. I can see the system in the console, but it is showing not up to date since the install time. 
 It has an update policy assigned to its group specifying both the primary and secondary update servers. When changes are made to this policy I see its policy compliance change to "awaiting transfer" and the changing back to "same as policy". 
 When I check the computer details from the console I see it does not have a primary or secondary update server configured. 
 The savupdate-debug.log is filled with these: 
 2020-06-27 12:24:57,677 DEBUG savupdate.util.Logger: NO-UPDATE-CONFIGURATION 2020-06-27 12:34:57,229 DEBUG savupdate.util.Logger: Logging to /opt/sophos-av/log/savupdate-debug.log 
 Am I doing something wrong with the update policy, or is it normal that I should need to configure this on each agent although they report back to the console? 
 I have verified DNS resolution to the server hosting the updates works and am using the fqdn in the update path. 
 Thank you

QC · Accepted Answer

Hello provisional Identity , 
 like the miller's daughter did to Rumpelstiltskin I'll first keep you in suspense. 
 "Sophos" as Secondary is fine and doesn't cause any problems (if the credentials, that are the same as in the Update Manager configuration, are correct). It definitely doesn't cause a NO-UPDATE-CONFIGURATION . 
 until I installed this agent how did you go about it? You must have installed from some CID, a path ending in \S nnn \savlinux\ , otherwise the endpoint would not report to and fetch policies from the server. What was the value for S nnn - the default Recommended subscription has S000. Do you have more than one Software Subscription in the Update managers view? 
 Coincidentally I noticed this behaviour (the NO-UPDATE-CONFIGURATION ) for the first time just the other day. Brought my laptop, that is most of the time at home, with me. At work it should update via UNC, this failing it should fall back to the Secondary web CID. This has worked for weeks. Well, it did not update and suddenly Primary and Secondary were gone in the details. Huh? 
 Turned out I has assigned an alternate updating policy to its group. As you can see it does not contain Linux. Looking at the Subscription in the Update managers view showed that indeed Linux wasn't selected. 
 What happens is the following: When SEC builds an updating policy it creates an XML with settings for all platforms. For platforms that are not selected in the chosen Subscription the updating paths are empty though and consequently the endpoint has effectively no configuration. Interestingly SEC does not warn you if you assign a policy/subscription to a group containing an endpoint with an "unselected" platform, or move the endpoint to a group with such a policy. SEC does refuse to change a Subscription when you try to unselect a platform from it and this Subscription is chosen in policies assigned to groups containing endpoints that would be affected. 
 I hope you can sort it out with this information. 
 Christian