This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Failed to install Sophos Patch Agent and Download of Sophos Patch Agent Failed

Hi, i've recently been having multiple end user machines reporting the errors above.

The systems are able to update the definitions but report the following errors, either of them.

Failed to install sophos patch agent 00000067  & Download of Sophos Patch Agent Failed 0000006b

The errors started to appear after 27th Jan 2015, beginning of this week.

All services are started, registry is updated with PrimaryServer IP, download of updates are not failing.

updating the registry with static IP helped resolve most of the Sophos patch agent failed error but the other couldn't be resolved.

I can't seem to figure out what's wrong with the recent set of releases. I think there has been an update to the Patch Agent resulting in these errors.

From the logs, i gathered the following.

Failed to install sophos patch agent 00000067

C:\ProgramData\Sophos\AutoUpdate\Logs

error shown: 

Trace(2015-Jan-29 10:04:19): CustomFileMap::Read: File path = C:\ProgramData\Sophos\AutoUpdate\cache\spa.custom
Trace(2015-Jan-29 10:04:19): CustomFileMap::Read: No custom file for product spa:{C58B1255-C24E-43d6-B2EB-9FB302B42E99} exists, generating a new one.
Trace(2015-Jan-29 10:04:19): SetupAction::Run: Prepare succeeded
Trace(2015-Jan-29 10:04:19): ALUpdate(Install.Failure): Sophos Patch Agent: 0x8000ffff
Trace(2015-Jan-29 10:04:19): Setup action thread finished with result state 0
Trace(2015-Jan-29 10:04:19): SetupAction::Execute: Thread to install Sophos Patch Agent returns 0
Trace(2015-Jan-29 10:04:20): RMSMessageHandler: ALUpdateEnd

C:\ProgramData\Sophos\Sophos Patch Agent\Logs

Info Msg: Successfully opened registry key
PATCH_SETUP_REGPATH: SOFTWARE\Sophos\Sophos Patch Agent\Setup
######
Date:01/29/15
Time:10:04:19
TID: 200412
ID: 2147549183
File: SetupPlugin.cpp
Line: 393
Evidence:

{ *BEGIN Exception Collection*
Code: 0x8000ffff Catastrophic failure
Evidence:
Info Msg: Product code change without version number change is not permitted
Stack Dump:

Source: SetupPlugin.cpp(316)
**END Exception Collection** }
Stack Dump:

######
Date:01/29/15
Time:10:04:19
TID: 200412
ID: 0
File: SetupPlugin.cpp
Line: 410
Evidence:
Info Msg: Return code to SAU:
hr: 0x8000ffff Catastrophic failure
Info Msg: REBOOTCODE returned to SAU:
*NeedRestart: 0
######

C:\Windows\Temp

The log files did not show any error in RMS or etc.

2015-01-29 10:04:18 Info: Running RunAfterScripts shared custom action.
2015-01-29 10:04:18 Info: Return Value from RunAfterScripts: 0
2015-01-29 10:04:18 Info: Shared custom actions succeeded.
2015-01-29 10:04:18 Info: Update to Sophos Anti-Virus succeeded.

:55595


This thread was automatically locked due to age.
  • Hello silentjess,

    updating the registry with static IP

    hm, perhaps I'm dense today - which key/value did you update?

    update to the Patch Agent

    I'm not aware there's been one. It's still 1.0.307.0 with SESC 10.3.12. AutoUpdate is attempting to install the 32-bit Patch Agent - dunno why it thinks it has to do so. Before the ALUpdate(Install.Failure): is there any indication that new files have been downloaded for Patch?

    Christian

    :55598
  • Hi QC:

    updating the registry with static IP

    hm, perhaps I'm dense today - which key/value did you update?

    i followed the steps here to specify the static IP address for the sophos rather than using sophos.domain.local:80

    i know the page is specifically for resolving installation issues but i noticed most of my clients had this configured so i figured if i changed it would it work? and it seems to.

    i specified the exact IP in registry:

     HKLM\Software\Sophos\Sophos Patch Agent\Setup\ with String: PrimaryServer value: 192.168.42.123:80

    most of the end points updated after, resolving 'Download of Sophos Patch Agent Failed' or 'ERROR: Could not find a source for updated packages'

    http://www.sophos.com/en-us/support/knowledgebase/113976.aspx

    update to the Patch Agent

    I'm not aware there's been one. It's still 1.0.307.0 with SESC 10.3.12. AutoUpdate is attempting to install the 32-bit Patch Agent - dunno why it thinks it has to do so. Before the ALUpdate(Install.Failure): is there any indication that new files have been downloaded for Patch?

     Here is the log for this morning, after 'Update Computer Now'

    I read through most of the items in the error log (C:\ProgramData\Sophos\AutoUpdate\Logs)

    Here's the log above the line ALUpdate(Install.Failure) 

    I cut it halfway through as the above was plainly downloading of new updates

    while the error is for Sophos Patch Agent.

    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): xvdl92.vdb
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): msil-bju.ide
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): zusy-w.ide
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): age-akpm.ide
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): Win8_i386\savonaccess.sys
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): delf-fvf.ide
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): xvdl73.vdb
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): xvdl41.vdb
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): bladab-h.ide
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): Windows\winsxs\ulCRTx86\msvcr90.dll
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): Windows\winsxs\dlCRTx86\msvcr90.dll
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): Windows\system32\msvcr90.dll
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): program files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter_64.dll
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): xvdl44.vdb
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): msil-bjc.ide
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): program files\Sophos\Sophos Anti-Virus\Web Control\WebControlPlugin.dll
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): vdl61.vdb
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): program files\Sophos\Sophos Anti-Virus\Web Control\WCPResFra.dll
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): WinLH_IA64\savonaccessdriv.inf
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): vdl48.vdb
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): age-akzr.ide
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): program files\Sophos\Sophos Anti-Virus\Web Intelligence\x64\swi_callout.inf
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): program files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_callout.inf
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): vdl58.vdb
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): staser-d.ide
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): vdl26.vdb
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): age-alew.ide
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): drivers\wxp_i386\skmscan.inf
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): xvdl23.vdb
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): vdl46.vdb
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): xvdl55.vdb
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): auto-aup.ide
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): docdl-en.ide
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): msil-bos.ide
    Trace(2015-Jan-30 09:38:13): CIDSync(CidSyncMessage): dyrez-bk.ide
    Trace(2015-Jan-30 09:38:13): CIDSyncCallback, SynchronisationTerminated - Code = 0
    Trace(2015-Jan-30 09:38:13): CIDSyncCallback, SynchronisationTerminated - MapFile = C:\ProgramData\Sophos\AutoUpdate\cache\savxp.map
    Trace(2015-Jan-30 09:38:13): AddSpecialRootFiles: theFile = savxp.map theRoot = C:\ProgramData\Sophos\AutoUpdate\cache
    Trace(2015-Jan-30 09:38:14): CIDUpdateLocation::SyncProduct - Product Checksum: c1d78fc40dd8d7f5f742834db0547b5b
    Trace(2015-Jan-30 09:38:14): CIDUpdate(DiscoveredSuccess):
    Trace(2015-Jan-30 09:38:15): UpdateLocationFacade::SyncProduct: Last Update Mechanism = CID
    Trace(2015-Jan-30 09:38:15): CIDUpdateLocation::SyncProduct - Updating Product: Sophos AutoUpdate
    Trace(2015-Jan-30 09:38:15): CIDUpdate(SyncProduct.Start): Sophos AutoUpdate, \\SOPHOS\SophosUpdate\CIDs\S000\SAVSCFXP
    Trace(2015-Jan-30 09:38:15): Checksum found in master.upd matches cached cidsync.upd : fba06088. Skipping download
    Trace(2015-Jan-30 09:38:15): CIDUpdate(DiscoveredSuccess):
    Trace(2015-Jan-30 09:38:15): UpdateLocationFacade::SyncProduct: Last Update Mechanism = CID
    Trace(2015-Jan-30 09:38:15): CIDUpdateLocation::SyncProduct - Updating Product: Sophos Patch Agent
    Trace(2015-Jan-30 09:38:15): CIDUpdate(SyncProduct.Start): Sophos Patch Agent, \\SOPHOS\SophosUpdate\CIDs\S000\SAVSCFXP
    Trace(2015-Jan-30 09:38:15): Checksum found in master.upd matches cached cidsync.upd : 16d4f6ff. Skipping download
    Trace(2015-Jan-30 09:38:15): CIDUpdate(DiscoveredSuccess):
    Trace(2015-Jan-30 09:38:16): ALUpdate(DownloadEnded):
    Trace(2015-Jan-30 09:38:16): UpdateCoordinator::UpdateNow: About to Action list of products
    Trace(2015-Jan-30 09:38:16): ALUpdate(Action.Skipped): RMSNT
    Trace(2015-Jan-30 09:38:16): CIDUpdateLocation::OnNullUpdate...
    Trace(2015-Jan-30 09:38:16): CustomFileMap::CustomFileMap. CachePath = C:\ProgramData\Sophos\AutoUpdate\cache
    Trace(2015-Jan-30 09:38:16): CustomFileMap::Read: Subfolder = rms productID = {390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92}
    Trace(2015-Jan-30 09:38:16): CustomFileMap::Read: File path = C:\ProgramData\Sophos\AutoUpdate\cache\rms.custom
    Trace(2015-Jan-30 09:38:16): CustomFileMap::Read: File exists and appears valid.
    Trace(2015-Jan-30 09:38:16): CIDUpdateLocation::OnNullUpdate complete.
    Trace(2015-Jan-30 09:38:16): SetupAction::Execute: Creating thread to install product SAVXP
    Trace(2015-Jan-30 09:38:16): Running setup action thread...
    Trace(2015-Jan-30 09:38:16): SetupAction::Run: Installing Product SAVXP
    Trace(2015-Jan-30 09:38:16): ALUpdate(Action.Execute): SAVXP
    Trace(2015-Jan-30 09:38:16): SetupAction::Run: Preparing...
    Trace(2015-Jan-30 09:38:16): CIDUpdateLocation::Prepare... entered
    Trace(2015-Jan-30 09:38:16): CheckManifest completed successfully
    Trace(2015-Jan-30 09:38:16): CustomFileMap::CustomFileMap. CachePath = C:\ProgramData\Sophos\AutoUpdate\cache
    Trace(2015-Jan-30 09:38:16): CustomFileMap::Read: Subfolder = savxp productID = {E17FE03B-0501-4aaa-BC69-0129D965F311}
    Trace(2015-Jan-30 09:38:16): CustomFileMap::Read: File path = C:\ProgramData\Sophos\AutoUpdate\cache\savxp.custom
    Trace(2015-Jan-30 09:38:16): CustomFileMap::Read: File exists and appears valid.
    Trace(2015-Jan-30 09:38:16): SetupAction::Run: Prepare succeeded
    Trace(2015-Jan-30 09:38:16): SetupAction::Execute: Could not create instance of IProductSetup2. Reverting to IProductSetup
    Trace(2015-Jan-30 09:38:18): ALUpdate(Action.Success):
    Trace(2015-Jan-30 09:38:18): SetupAction::Execute: Successfully installed Product from : C:\ProgramData\Sophos\AutoUpdate\cache\savxp
    Trace(2015-Jan-30 09:38:18): Setup action thread finished with result state 1
    Trace(2015-Jan-30 09:38:18): SetupAction::Execute: Thread to install SAVXP returns 1
    Trace(2015-Jan-30 09:38:18): ALUpdate(Action.Skipped): Sophos AutoUpdate
    Trace(2015-Jan-30 09:38:18): CIDUpdateLocation::Prepare... entered
    Trace(2015-Jan-30 09:38:19): CheckManifest completed successfully
    Trace(2015-Jan-30 09:38:19): CustomFileMap::CustomFileMap. CachePath = C:\ProgramData\Sophos\AutoUpdate\cache
    Trace(2015-Jan-30 09:38:19): CustomFileMap::Read: Subfolder = sau productID = {9BF40A4E-23AE-48be-9974-5A1F261DBEE8}
    Trace(2015-Jan-30 09:38:19): CustomFileMap::Read: File path = C:\ProgramData\Sophos\AutoUpdate\cache\sau.custom
    Trace(2015-Jan-30 09:38:19): CustomFileMap::Read: File exists and appears valid.
    Trace(2015-Jan-30 09:38:19): Updating subscription information from product ID data.
    Trace(2015-Jan-30 09:38:19): Rigid name: F26F7EC0-1302-4DA7-8B6B-A5383051D41A
    Trace(2015-Jan-30 09:38:19): Version: 10.3.12.3550.555.4
    Trace(2015-Jan-30 09:38:19): CIDUpdateLocation::OnNullUpdate...
    Trace(2015-Jan-30 09:38:19): CustomFileMap::CustomFileMap. CachePath = C:\ProgramData\Sophos\AutoUpdate\cache
    Trace(2015-Jan-30 09:38:19): CustomFileMap::Read: Subfolder = sau productID = {9BF40A4E-23AE-48be-9974-5A1F261DBEE8}
    Trace(2015-Jan-30 09:38:19): CustomFileMap::Read: File path = C:\ProgramData\Sophos\AutoUpdate\cache\sau.custom
    Trace(2015-Jan-30 09:38:19): CustomFileMap::Read: File exists and appears valid.
    Trace(2015-Jan-30 09:38:19): CIDUpdateLocation::OnNullUpdate complete.
    Trace(2015-Jan-30 09:38:19): SetupAction::Execute: Creating thread to install product Sophos Patch Agent
    Trace(2015-Jan-30 09:38:19): Running setup action thread...
    Trace(2015-Jan-30 09:38:19): SetupAction::Run: Installing Product Sophos Patch Agent
    Trace(2015-Jan-30 09:38:19): ALUpdate(Action.Execute): Sophos Patch Agent
    Trace(2015-Jan-30 09:38:19): SetupAction::Run: Preparing...
    Trace(2015-Jan-30 09:38:19): CIDUpdateLocation::Prepare... entered
    Trace(2015-Jan-30 09:38:19): CheckManifest completed successfully
    Trace(2015-Jan-30 09:38:19): CustomFileMap::CustomFileMap. CachePath = C:\ProgramData\Sophos\AutoUpdate\cache
    Trace(2015-Jan-30 09:38:19): CustomFileMap::Read: Subfolder = spa productID = {C58B1255-C24E-43d6-B2EB-9FB302B42E99}
    Trace(2015-Jan-30 09:38:19): CustomFileMap::Read: File path = C:\ProgramData\Sophos\AutoUpdate\cache\spa.custom
    Trace(2015-Jan-30 09:38:19): CustomFileMap::Read: File exists and appears valid.
    Trace(2015-Jan-30 09:38:19): SetupAction::Run: Prepare succeeded
    Trace(2015-Jan-30 09:38:20): ALUpdate(Install.Failure): Sophos Patch Agent: 0x8000ffff
    Trace(2015-Jan-30 09:38:20): Setup action thread finished with result state 0
    Trace(2015-Jan-30 09:38:20): SetupAction::Execute: Thread to install Sophos Patch Agent returns 0
    Trace(2015-Jan-30 09:38:21): RMSMessageHandler: ALUpdateEnd
    Trace(2015-Jan-30 09:38:21): Sending message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSEndUpdate"><ErrorMessage><ID>Install.Failure</ID><StringID>103</StringID><Sender>ALUpdate</Sender><Insert>Sophos Patch Agent</Insert><Insert>8000ffff</Insert></ErrorMessage></Config>
    Trace(2015-Jan-30 09:38:21): IPCSender::Write: Writing message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSEndUpdate"><ErrorMessage><ID>Install.Failure</ID><StringID>103</StringID><Sender>ALUpdate</Sender><Insert>Sophos Patch Agent</Insert><Insert>8000ffff</Insert></ErrorMessage></Config>
    Trace(2015-Jan-30 09:38:21): IPCSender::ProcessSend: Send message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSEndUpdate"><ErrorMessage><ID>Install.Failure</ID><StringID>103</StringID><Sender>ALUpdate</Sender><Insert>Sophos Patch Agent</Insert><Insert>8000ffff</Insert></ErrorMessage></Config>
    Trace(2015-Jan-30 09:38:21): IPCSender::ProcessSend: No messages in queue, starting to wait
    Trace(2015-Jan-30 09:38:22): IPCSender::ProcessSend exiting

    Many thanks for your help!

    I sort of realised that the Sophos Patch Agent could be trying to update itself due to the Registry edit

    but if it was true, then why didn't this error appear earlier? I've even tried to remove PrimaryServer to verify if the error would go away but it didn't either.

    Most of the clients have the registry item and there isn't any GPO forcing this to the clients nor have any IT personnel made changes to the GPO.

    :55608
  • Hello silentjess,

    I see. There must be some inconsistency somewhere. I've never had similar problems with Patch so my knowledge is very limited. Better contact Support directly (it's included in the license so why not give them a chance :smileywink:).

    Christian

    :55611
  • Hi QC,

    Thanks for the help, i thought you were a sophos staff!

    I've opened a case with Sophos help.

    they suggested the following:

    which i've already done so and it didn't resolve the issue.

    I hope others whom are having similar issues can use the steps given by sophos.

    -----------------------------------------
    Article ID: 113976
    Title: How to install the Sophos Patch Agent without re-deploying Sophos endpoint security software
    URL: https://sophos.com/kb/113976
    -----------------------------------------

    Add an exclusion to the Indexing Service for the AutoUpdate cache folder in order to allow updates to proceed:

      1. Right-click "My Computer" and select "Manage". 
      2. In the Computer Management window, open Services & Applications | Indexing Service | System | Directories.
      3. Under the list of directories, click the right mouse button and select New and then Directory.
      4. In the Add Directory window:
        1. Browse to, or type the following location:
          C:\Program Files\Sophos\AutoUpdate\Cache and also add the Windows\temp directory
        2. In the ‘‘‘‘Include in Index’’’’ area, Select No.
        3. Click OK to add the excluded location to the Indexing Service locations.
    1. Restart the Indexing Service. In the Computer Management window, select Services and then locate 'Indexing Service' in the list. Restart the service.
    2. When the Indexing Service has restarted, right-click the Sophos icon and select Update Now.
    :55643
  • Hello silentjess,

    it still doesn't work? Or?

    Christian

    :55715
  • Hi QC,

    It worked for one end point during the remote session with sophos callcentre - stopping services and reprotect.

    The disabling of Indexing doesn't help. i did it on the GPO level so all endpoints would have indexing disabled for sophos folders.

    I'm still having multiple end points reporting Failed to install Sophos Patch Agent but i've left it alone for now as they seem to automatically resolve themselves randomly (??)

    For some, disabling all sophos services and running 'Protect Computer' resolved the issue.

    For some, changing the PrimaryServer to IP address of sophos server resolve the issue.

    I've even tried deleting items in Cache C:\ProgramData\Sophos\Sophos Autoupdate\Cache\, reading the logs, doing manual uninstallation. sometimes it works sometimes it doesn't.

    Thanks for following up, i hope my feedback helped others too.

    :55775