Sophos Enterprise Console will not open following 5.5.2 update - "unable to log in as the specified user"

RE: Sophos Enterprise Console will not open following 5.5.2 update - "unable to log in as the specified user"

QC — Tue, 25 Aug 2020 14:04:50 GMT

Hello SimpleTechie,

I'm not aware that the upgrade removes these settings. Is there a ClientMRInit log from around the time of the upgrade somewhere (indeed I mean searching the whole C: drive)? Or is there a hint that ClientMRInit has been run in the server64 msi log? As said, as far as I can tell it hasn't been run on the two servers I've upgraded.

Christian

RE: Sophos Enterprise Console will not open following 5.5.2 update - "unable to log in as the specified user"

SimpleTechie — Tue, 25 Aug 2020 13:56:47 GMT

Yes this was an update from 5.5.1 to 5.5.2 but the database is on a remote server.

Looking at the HKEYLM>SOFTWARE>WOW6432Node>Sophos>Messaging System>Router keys there seems to be only a few:

Compared to the production 5.5.1 install:

Its seeing more and more like something has not ran during the installation of settings have been removed during the update to 5.5.2

RE: Sophos Enterprise Console will not open following 5.5.2 update - "unable to log in as the specified user"

QC — Tue, 25 Aug 2020 13:51:51 GMT

Hello SimpleTechie,

SUM shouldn't cause troubles.
There's something not working as it should. Never seen this type of error and my interpretation is perhaps wrong. It looks like Auditing is enabled (Console Tools → Manage Auditing ...) but fails. If the console also crashes (provided it can still be started) on other actions (like moving a computer to another group) with a similar error I'd try to re-run the Installer (SEC's setup.exe) though I'm not sure that it'd help.

Was this a 5.5.1 to 5.5.2 upgrade with a local database?

Christian

RE: Sophos Enterprise Console will not open following 5.5.2 update - "unable to log in as the specified user"

SimpleTechie — Tue, 25 Aug 2020 12:34:52 GMT

Thank you again

Seems like my troubles have not ended, it took a long time to get the SUM to work on the SEC Server and the secondary SUM is not working aswell. However after successfully updating the SUM with the latest av definitions and attempting to run an update on an online device I get the following. After this the console crashes:

Failed to open audit event
----- [outer exception] -----
-- error: 0x829E0033
-- facility: Sophos Management Service Exception
-- source: struct ISMT_ComputerActions

at void __thiscall bl::UpdateAction::ApplyToComputerList(const class bl::ComputerList &)
at void __thiscall CCompListCtrl::ApplyToSelectedItems(class bl::ActionBase &)
at long __thiscall CCompListCtrl::OnActionForceUpdate(unsigned short,unsigned short,struct HWND__ *,int &)
at int __cdecl Run(int,class bl::CommandLine,enum bl::ConsoleType::Type)
at int __stdcall wWinMain(struct HINSTANCE__ *,struct HINSTANCE__ *,wchar_t *,int)

In the event Log:

Audit event was not created:
Sophos.Management.Auditing.Interfaces.AuditException: Failed to open audit event ---> Sophos.Management.Dali.SPException: Stored procedure call returned error: 2
at Sophos.Management.Data.SPErrorHandler.CheckReturnCode(SqlCommand cmd)
at Sophos.Management.Data.GeneralCommand.ExecuteImpl()
at Sophos.Management.Data.Utils.ExecuteAndHandleTransientErrors(ISqlConnectionContext scc, MethodThatMayThrowTransientError methodToCall)
at Sophos.Management.Data.GeneralCommand.Execute()
at Sophos.Management.Auditing.EventRepository.AddBeginEvent(BeginEvent beginEvent)
at Sophos.Management.Auditing.AuditLog.BeginEvent(String sessionId, AuditAction action, AuditTargetType targetType, String targetName, AuditParameterType parameterType, String parameterValue, Int32 targetSubType, String configData)
--- End of inner exception stack trace ---

RE: Sophos Enterprise Console will not open following 5.5.2 update - "unable to log in as the specified user"

QC — Tue, 25 Aug 2020 10:51:13 GMT

Hello SimpleTechie,

the RMS version hasn't changed so there shouldn't be major differences. Guess ClientMRInit.exe is responsible for setting these values based on MRInit.conf. As far as I can see it hasn't been run when I upgraded 5.5.1 to 5.5.2.

Christian

RE: Sophos Enterprise Console will not open following 5.5.2 update - "unable to log in as the specified user"

SimpleTechie — Tue, 25 Aug 2020 08:33:05 GMT

Amazing create the IORSenderPort DWord and the services have started along with the Enterprise console now been accessible. Though comparing the HKLM\SOFTWARE\Wow6432Node\Sophos\Messaging System\Router\ to the same location on the customer's 5.5.1 installation there is a big difference in the number of keys present.

This does seem very odd and something I really need to get to support then I guess as I certainly cannot explain such a weird behaviour.

RE: Sophos Enterprise Console will not open following 5.5.2 update - "unable to log in as the specified user"

QC — Tue, 25 Aug 2020 08:13:01 GMT

Hello SimpleTechie,

I can provoke the same error messages from the Agent when I remove the value IORSenderPort from the HKLM\SOFTWARE\Wow6432Node\Sophos\Messaging System\Router\ registry key. Can't say though why it should disappear or the Agent fail to retrieve it.

Christian

RE: Sophos Enterprise Console will not open following 5.5.2 update - "unable to log in as the specified user"

SimpleTechie — Tue, 25 Aug 2020 07:30:43 GMT

Checking the logs Im not seeing anything of note:

20.08.2020 16:27:42 0A0C I Successfully validated this router's IOR gets logged and then a few resolved entries followed by the below and previous logs appear to be the same

24.08.2020 09:27:10 0490 I Waiting for messages...
24.08.2020 09:27:10 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 9, max number of user ports 15360
24.08.2020 10:27:10 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 11:27:10 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 12:27:10 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 13:27:10 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 14:27:10 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 15:27:11 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 16:27:11 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 17:27:11 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 18:27:11 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 19:27:11 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 20:27:11 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 21:27:11 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 22:27:11 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
24.08.2020 23:27:12 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
25.08.2020 00:27:12 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
25.08.2020 01:27:12 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
25.08.2020 02:27:12 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
25.08.2020 03:27:12 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
25.08.2020 04:27:12 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
25.08.2020 05:27:13 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
25.08.2020 06:27:13 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360
25.08.2020 07:27:13 0490 I RouterSystemCheck::onInfoPortsUsed() - number of user ports 10, max number of user ports 15360

Looking in the agent log I see the following:

25.08.2020 08:28:51 1C20 E MSClient::InitialiseClientLibraryLocal: failed to get the port number for the local message router.
25.08.2020 08:28:51 1C20 E Agent::Start: Caught MSClient::InitialiseClientLibraryLocal: failed to get the port number for the local message router.

25.08.2020 08:28:51 1C20 I Shutting down...
25.08.2020 08:28:51 1C20 I Stopping AdapterManager ...
25.08.2020 08:28:55 0348 I Terminating the AdapterMonitor thread ...
25.08.2020 08:28:55 1C20 I Unloading adapter SDDM ...
25.08.2020 08:28:55 1C20 I SDDMA: The socket 820 was shut down.
25.08.2020 08:28:55 1C20 I SDDMA: The socket 820 was closed.
25.08.2020 08:28:55 1228 I SDDMA: Socket 4294967295: receive failed with error code 10004.
25.08.2020 08:28:55 1C20 I Restarting...

RE: Sophos Enterprise Console will not open following 5.5.2 update - "unable to log in as the specified user"

QC — Mon, 24 Aug 2020 16:35:50 GMT

Hello Stephen Onyons,

the Sophos Message Router is running but the Sophos Agent isn't? I'd check the logs for Router and Agent. What's the process that reports the first event?

Christian