Windows server (2008 R2 and 2012) were dump when sophos update

Hello Hut,

the logs for the installs or uninstalls performed during updating are in %windir%\Temp\.

Christian

Hi Christian,

I check in the directory and recognize that  the log file Sophos HitmanPro Alert install log is empty.

Hut,

Hello Hut,

the release notes list two issues but the description is rather vague. If you did reboot your endpoints the first doesn't apply. No other log (MSIxxxx) that could be related to EXP?
You could also check the ALUpdate logs (%ProgramData%\Sophos\AutoUpdate\Logs\) but I assume it just says failed.

Christian

Hi Christian,

 The following logs were written in the ALUpdate log when client servers update sophos. However, the log file wasn't written when client servers were dumped.

Trace(2017-Jun-07 15:36:42): Attempting to make a connection to remote machine \\ServerVIRUS\SophosUpdate\CIDs\S000\OPMHMPA
Trace(2017-Jun-07 15:36:42): Connection to remote machine \\ServerVIRUS\SophosUpdate\CIDs\S000\OPMHMPA successful
Trace(2017-Jun-07 15:36:42): Custom certificate already present.
Trace(2017-Jun-07 15:36:42): Not primary update location. Will not process license, credentials and product id files.
Trace(2017-Jun-07 15:36:42): Remote connection over UNC.
Trace(2017-Jun-07 15:36:42): Read file master.upd (Remote).
Trace(2017-Jun-07 15:36:42): Synchronised file root.upd (Remote).
Trace(2017-Jun-07 15:36:42): ParseCustomerIDFile: completed: 0
Trace(2017-Jun-07 15:36:42): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Calling SyncProduct with {244E68BF-E1BB-4A6B-AC18-A492DE0134C0}
Trace(2017-Jun-07 15:36:42): CIDUpdateLocation::SyncProduct - Updating Product: Sophos HitmanPro Alert
Trace(2017-Jun-07 15:36:42): CIDUpdate(SyncProduct.Start): Sophos HitmanPro Alert, \\ServerVIRUS\SophosUpdate\CIDs\S000\OPMHMPA
Trace(2017-Jun-07 15:36:42): Checksum found in master.upd matches cached cidsync.upd : 97cb15a3. Skipping download
Trace(2017-Jun-07 15:36:42): CIDUpdate(PrimarySuccess):
Trace(2017-Jun-07 15:36:42): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, SyncProduct returned - 1
Trace(2017-Jun-07 15:36:42): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Ended - 1
Trace(2017-Jun-07 15:36:42): UpdateLocationFacade::SyncProduct: Last Update Mechanism = CID
Trace(2017-Jun-07 15:36:42): CIDUpdateLocation::SyncProduct - Updating Product: Sophos Clean
Trace(2017-Jun-07 15:36:42): CIDUpdate(SyncProduct.Start): Sophos Clean, \\ServerVIRUS\SophosUpdate\CIDs\S000\OPMHMPA
Trace(2017-Jun-07 15:36:42): Checksum found in master.upd matches cached cidsync.upd : 1d576557. Skipping download
Trace(2017-Jun-07 15:36:42): CIDUpdate(PrimarySuccess):
Trace(2017-Jun-07 15:36:42): ALUpdate(DownloadEnded):
Trace(2017-Jun-07 15:36:42): UpdateCoordinator::UpdateNow: About to Action list of products
Trace(2017-Jun-07 15:36:42): SimpleProduct::DoAction isLater==false skipAction==false isUninstall==false m_lastUpdateSucceeded==true numfilestocahce 1 Actiontype SetupNot preinstalled product
Trace(2017-Jun-07 15:36:42): Null update
Trace(2017-Jun-07 15:36:42): ALUpdate(Action.Skipped): RMSNT
Trace(2017-Jun-07 15:36:42): CIDUpdateLocation::OnNullUpdate...
Trace(2017-Jun-07 15:36:42): CustomFileMap::CustomFileMap. CachePath = C:\ProgramData\Sophos\AutoUpdate\cache
Trace(2017-Jun-07 15:36:42): CustomFileMap::Read: Subfolder = rms productID = {390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92}
Trace(2017-Jun-07 15:3  -- - > Blue screen appear 

Trace(2017-Jun-07 15:46:22): Attempting to make a connection to remote machine \\ServerVIRUS\SophosUpdate\CIDs\S000\OPMHMPA
Trace(2017-Jun-07 15:46:22): Connection to remote machine \\ServerVIRUS\SophosUpdate\CIDs\S000\OPMHMPA successful
Trace(2017-Jun-07 15:46:22): Custom certificate already present.
Trace(2017-Jun-07 15:46:22): Not primary update location. Will not process license, credentials and product id files.
Trace(2017-Jun-07 15:46:22): Remote connection over UNC.
Trace(2017-Jun-07 15:46:22): Read file master.upd (Remote).
Trace(2017-Jun-07 15:46:22): Synchronised file root.upd (Remote).
Trace(2017-Jun-07 15:46:22): ParseCustomerIDFile: completed: 0
Trace(2017-Jun-07 15:46:22): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Calling SyncProduct with {244E68BF-E1BB-4A6B-AC18-A492DE0134C0}
Trace(2017-Jun-07 15:46:22): CIDUpdateLocation::SyncProduct - Updating Product: Sophos HitmanPro Alert
Trace(2017-Jun-07 15:46:22): CIDUpdate(SyncProduct.Start): Sophos HitmanPro Alert, \\ServerVIRUS\SophosUpdate\CIDs\S000\OPMHMPA
Trace(2017-Jun-07 15:46:22): Checksum found in master.upd matches cached cidsync.upd : 97cb15a3. Skipping download
Trace(2017-Jun-07 15:46:22): CIDUpdate(PrimarySuccess):
Trace(2017-Jun-07 15:46:22): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, SyncProduct returned - 1
Trace(2017-Jun-07 15:46:22): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Ended - 1
Trace(2017-Jun-07 15:46:22): UpdateLocationFacade::SyncProduct: Last Update Mechanism = CID
Trace(2017-Jun-07 15:46:22): CIDUpdateLocation::SyncProduct - Updating Product: Sophos Clean
Trace(2017-Jun-07 15:46:22): CIDUpdate(SyncProduct.Start): Sophos Clean, \\ServerVIRUS\SophosUpdate\CIDs\S000\OPMHMPA
Trace(2017-Jun-07 15:46:22): Checksum found in master.upd matches cached cidsync.upd : 1d576557. Skipping download
Trace(2017-Jun-07 15:46:22): CIDUpdate(PrimarySuccess):
Trace(2017-Jun-07 15:46:22): ALUpdate(DownloadEnded):
Trace(2017-Jun-07 15:46:22): UpdateCoordinator::UpdateNow: About to Action list of products
Trace(2017-Jun-07 15:46:22): SimpleProduct::DoAction isLater==false skipAction==false isUninstall==false m_lastUpdateSucceeded==true numfilestocahce 1 Actiontype SetupNot preinstalled product
Trace(2017-Jun-07 15:46:22): Null update
Trace(2017-Jun-07 15:46:22): ALUpdate(Action.Skipped): RMSNT
Trace(2017-Jun-07 15:46:22): CIDUpdateLocation::OnNullUpdate...
Trace(2017-Jun-07 15:46:22): CustomFileMap::CustomFileMap. CachePath = C:\ProgramData\Sophos\AutoUpdate\cache
Trace(2017-Jun-07 15:46:22): CustomFileMap::Read: Subfolder = rms productID = {390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92}
Trace(2017-Jun-07 15:4 --- >  -- - > Blue screen appear

The error occurs HitmanPro Alert update from version 3.6.3.583 to 3.6.3.593

When I stop auto update sophos service, the problem is solved.

I also attached the file dump in client server.

Regards.

Hut,

Hello Hut,

you say you have the same symptoms on more than one machine? On all of them?

Christian

Given the reference to the filter manager in that screenshot of a dump, I suspect it's the same problem as detailed here:

https://community.sophos.com/products/endpoint-security-control/f/sophos-endpoint-software/92654/server-2012-r2-bsod-on-20-servers-any-thoughts

Hi Christian,

All of client servers (windows 2008 R2 and windows 2012) have same symtoms. The clients using Windows 10, 8, 7  don't have the problem.

Hut,

Hi Jak,

Exactly, my problem is same the case.

Thanks,

Hut,