update error (s)

Hello novw,

what I deduce from the log:

• the endpoint is unmanaged (there's no mention of RMSNT) with the Primary update location set to a company web server and Secondary set to Sophos
• your Primary CID is fine (AutoUpdate is current)
• downloading of SAVXP fails from both the Primary and Secondary

I don't think it's temporary, OTOH it's likely not permanent (bad pun :smileytongue:). The ALUpdate log (in %ProgramData%\Sophos\AutoUpdate\Logs) should have details on the error (which seems to happen shortly after the start of the download) -it should not be too hard to find the relevant lines. Please post a snippet here. BTW: Which SAV version?

Christian

Trace(2014-May-26 12:14:21): ALUpdate started: -ScheduledUpdate  -NoGUI -RootPath "C:\Program Files (x86)\Sophos\AutoUpdate"
Trace(2014-May-26 12:14:21): Process security set successfully
Trace(2014-May-26 12:14:21): Product subscription is disabled: iProductData.{390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92} action value is:0
Trace(2014-May-26 12:14:21): Product iProductData.{390DCDC2-10A9-4ef3-B8D8-0CA7F0E7EB92} has not been added.
Trace(2014-May-26 12:14:21): Product subscription is disabled: iProductData.{D752FAB9-5883-4b36-8740-61565B6BAD29} action value is:0
Trace(2014-May-26 12:14:21): Product iProductData.{D752FAB9-5883-4b36-8740-61565B6BAD29} has not been added.
Trace(2014-May-26 12:14:21): Product iProductData.{E17FE03B-0501-4aaa-BC69-0129D965F311} has been added.
Trace(2014-May-26 12:14:21): Product iProductData.{E17FE03B-0501-4aaa-BC69-0129D965F311} is  available from Sophos.
Trace(2014-May-26 12:14:21): Product iProductData.{E17FE03B-0501-4aaa-BC69-0129D965F311} is not  the Spam Rules package.
Trace(2014-May-26 12:14:21): Product subscription is disabled: iProductData.{7998C326-2CA5-4830-B7D2-B792D2460975} action value is:0
Trace(2014-May-26 12:14:21): Product iProductData.{7998C326-2CA5-4830-B7D2-B792D2460975} has not been added.
Trace(2014-May-26 12:14:21): Product iProductData.{3B758ED7-87C1-4e89-BDE1-F49DFF1249F6} has not been added.
Trace(2014-May-26 12:14:21): Product iProductData.{B5E7E2A7-3B64-437D-801F-21CC9D67CC6D} has been added.
Trace(2014-May-26 12:14:21): Product iProductData.{B5E7E2A7-3B64-437D-801F-21CC9D67CC6D} is  available from Sophos.
Trace(2014-May-26 12:14:21): Product iProductData.{B5E7E2A7-3B64-437D-801F-21CC9D67CC6D} is  the Spam Rules package.
Trace(2014-May-26 12:14:21): Computer is a not possible cluster
Trace(2014-May-26 12:14:21): PureMessageDetector::AreSpamRulesRequired - Could not open registry on Software\Sophos\MMEx\Config\Global
Trace(2014-May-26 12:14:21): ConfigurationImpl, considering PMSR 2.6: PureMessage not installed, PMSR package will not be updated without a subscription
Trace(2014-May-26 12:14:21): Considering subscribed products.
Trace(2014-May-26 12:14:21): Considering product {9BF40A4E-23AE-48be-9974-5A1F261DBEE8}
Trace(2014-May-26 12:14:21): Product {9BF40A4E-23AE-48be-9974-5A1F261DBEE8} is not already subscribed.
Trace(2014-May-26 12:14:21): Product {9BF40A4E-23AE-48be-9974-5A1F261DBEE8} was added to the list.
Trace(2014-May-26 12:14:21): IPCBase::IPCBase: Initialising shared memory A32951C539924a12B3C8F2FDA5A268E4
Trace(2014-May-26 12:14:21): IPCSender::ProcessSend started
Trace(2014-May-26 12:14:21): IPCSender::ProcessSend: No messages in queue, starting to wait
Trace(2014-May-26 12:14:21): RMSMessageHandler: ALUpdateStart
Trace(2014-May-26 12:14:21): IPCSender::Write: Writing message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSStartUpdate" />
Trace(2014-May-26 12:14:21): IPCSender::ProcessSend: Send message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSStartUpdate" />
Trace(2014-May-26 12:14:21): IPCSender::ProcessSend: No messages in queue, starting to wait
Trace(2014-May-26 12:14:21): ALUpdate(AutoUpdate.Started): 
Trace(2014-May-26 12:14:21): UpdateCoordinator::UpdateNow: Entering
Trace(2014-May-26 12:14:21): PopulateCache: Entering
Trace(2014-May-26 12:14:21): ProductFactory::Create: SimpleProduct: {E17FE03B-0501-4aaa-BC69-0129D965F311}
Trace(2014-May-26 12:14:21): ProductFactory::Create: SAU Product
Trace(2014-May-26 12:14:21): UpdateCoordinator::UpdateNow: About to Sync list of products
Trace(2014-May-26 12:14:21): UpdateLocationFacade::SyncProduct: Last Update Mechanism = CID
Trace(2014-May-26 12:14:21): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Started: 
Trace(2014-May-26 12:14:21): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, creating update location
Trace(2014-May-26 12:14:21): Calling package_source_init
Trace(2014-May-26 12:14:21): TrySyncProduct, Calling BeginSync
Trace(2014-May-26 12:14:21): Custom certificate already present.
Trace(2014-May-26 12:14:21): CalculateChecksum. Processing file C:\ProgramData\Sophos\AutoUpdate\cache\escdp.dat
Trace(2014-May-26 12:14:21): Remote connection over HTTP.
Trace(2014-May-26 12:14:21): Read file master.upd (Remote).
Trace(2014-May-26 12:14:21): Synchronised file root.upd (Local).
Trace(2014-May-26 12:14:21): Synchronised file escdp.dat (Local).
Trace(2014-May-26 12:14:21): CalculateChecksum. Processing file C:\ProgramData\Sophos\AutoUpdate\cache\ProductID.dat
Trace(2014-May-26 12:14:21): Synchronised file ProductID.dat (Local).
Trace(2014-May-26 12:14:21): ParseCustomerIDFile: completed: 0
Trace(2014-May-26 12:14:21): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Calling SyncProduct with {E17FE03B-0501-4aaa-BC69-0129D965F311}
Trace(2014-May-26 12:14:21): CIDUpdateLocation::SyncProduct - Updating Product: SAVXP
Trace(2014-May-26 12:14:21): CIDUpdate(SyncProduct.Start): SAVXP, ***.nl/sophos/savscfxp/
Trace(2014-May-26 12:14:21): CIDUpdateLocation::Sync - Updating from http CID: ***.nl/sophos/savscfxp/savxp
Trace(2014-May-26 12:14:21): CIDSync(CidSyncMessage): 

<snip>

Trace(2014-May-26 12:14:43): CIDSync(CidSyncMessage): savsync.upd
Trace(2014-May-26 12:14:43): CIDSync(CidSyncMessage): vdlsync.upd
Trace(2014-May-26 12:14:43): CIDSync(CidSyncMessage): ClassFilterDrivers\w2k_i386\sdcfilter.sys
Trace(2014-May-26 12:14:43): CIDSync(CidSyncMessage): java-tm.ide

jkes...big post... bigbig big post. So big I can't even post loigs from 2014-May-26. With one single start of Sophos. What parts would you be interested in mostly? I pasted all of the starting and the last bit of the end of the log. Nowhere is "failed" "error" or simular.

Sophos version is 10.3 and I am running W7 home edition. By the way, whenever I right click the sophos icon in  the toolbar, windows system requests me if I am sure I want to allow sophos anti-virus to make changes to my harddisc. Thats pretty annoying (ofcourse (!) I'll allow), but probarbly not a part of the problem?

PS: Please talk baby to me... I am only an amateur ;)

Hello novw,

allow sophos anti-virus to make changes

this is normal behaviour in conjunction with UAC (User Account Control) - and it's not changes to your disk but the computer. Anyway, this is a different topic.

The <snip> should have been bigger, the interesting part starts with the last CIDSync(CidSyncMessage):. which is followed by some different message. :smileyhappy:

Christian

https://dl.dropboxusercontent.com/u/51257566/sophos.txt ;) I can make it even bigger if you want to, but this was the entire thing after first boot today.

Thank you for trying to help! :robothappy:

(see: talk baby to me... I can simply attach .txt to this post...)

Hello novw,

this one is cut off (for whatever reason) before the interesting part. It doesn't have to be from the last update attempt but please make sure it contains the error (if necessary a complete cycle from one ALUpdate started: to the next).

Christian

I have a total of 4 logs:

ALUpdate20140427T121415.5800860.log

ALUpdate20140430T132301.9975060.log

ALUpdate20140516T114422.9342230.log

ALUpdate20140520T144109.2865130.log

The last one seems to be the newest. It has been attached completely. I even omited editing the update servers. I hope this helps (more)

--

edit

--

The updating window shows, till it reaches 13 seconds, than stalls for 10 seconds, than it pops could not connect to update server (?)

Windows security center is beginning to pester me. My virus scanner is reporting it is old. Duh! Than update already!

I am afraid I will have to get rid of sophos? I mean a non-updating virus scanner is only eating CPU time and not making any sense.

Hello novw,

sorry for the delay.

Can't say what's causing the unknown error when updating from the .nl server - guess this can't easily be resolved in this forum. You should turn to the administrators there for help. Somehow the failed update (upgrade?) seems to cause updates from Sophos to fail as well.

There's one thing you could try on your own - delete the contents of \ProgramData\Sophos\AutoUpdate\Cache\. this should do no harm. I don't think it will resolve the problem, but who knows.

Christian

Funny thing you mention update ;) I complained at the .nl side of things and they did some magic. Suddenly Sophos wanted me to reboot my computer and after that: updates run again.

Sigh. Its one of those things...

Thank you for your attempts to help!