Thread Info
  • State Not Answered
  • +3 person also asked this people also asked this
  • Locked Locked
  • Replies 10 replies
  • Subscribers 11 subscribers
  • Views 38104 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

e03d0056

TedMoyers
I am getting this error code: e03d0056 using Sophos Enterprise Console version 5.4.0 on a few of our Sophos managed computers. I ask this because when I click on the corresponding link under the Computer Details screen, I get this: Your search - sav - e03d0056 site:www.sophos.com/en-US/support/knowledgebase - did not match any documents. No pages were found containing "sav - e03d0056 site:www.sophos.com/en-US/support/knowledgebase". Under the Scanning errors column, it shows, "; The on-access driver failed to determine the name for a file. [0xe03d0056]". What I am hoping for is information that provides: where to look, what it is, what could be causing it, the importance, or a possible solution.


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to logan williams

    Same here. How do I resolve this?

  • 0 in reply to Teri Grinnell

    The on-access driver failed to determine the name for a file. [e03d0056] seems of little use.

    I would suggest to suppress it: e03d0056 as a 32-bit signed dec is: -532873130.

    PS C:\> [int]::Parse('e03d0056',"HexNumber")
    -532873130

    There is a table in the 'core' database called: "ErrorAlertFilters"; you could try using this to filter it out in the future, for example the command (admin prompt):

    sqlcmd -E -S .\sophos -d SOPHOS550 -Q "INSERT INTO ErrorAlertFilters (Source, Number) VALUES ('SAV', '-532873130') "

    I have assumed a default local Sophos instance (.\sophos)  is being used and SEC 5.5, hence the SOPHOS550 database name.  
    For more details on the database name see: https://community.sophos.com/kb/en-us/17323
    For locating the instance of SQL in use by SEC see: https://community.sophos.com/kb/en-us/113030 

    This will prevent the "SAV" message being displayed in SEC in the future if you acknowledge the current ones.

    Hopefully that helps.

    Regards,

    Jak

  • 0 in reply to Wallsy

    Hello,

    I further investigated this often happening alerts on Sophos Enterprise Console for Anti Virus.

    It seems to me this can be reproduced when a user tries to click on a windows .lnk file that refers to an unavailable network drive location (e.g. network drive no longer mapped).

    I then noticed, right clicking this "dead link" .lnk file and choosing "Scan with Sophos Anti Virus" ends in an "Unknown Error".

    This should be fixed by sophos after investigation if its really a bug.

    Thanks and kind regards

  • 0 in reply to Polygon-tre

    I will give this a go and see if I can replicate you are seeing, Sophos have not been the best with this one.

     

  • 0 in reply to Wallsy

    This error is not random for one of our laptops running Windows 10 and the preview version of endpoint.

    Open SEC acknowledge this error and any others(e03d000f and a05800c) reboot the laptop and before I can login error e03d0056 is back followed by e03d00f and then a05800c.

     

    I am really starting to think it is normal for sophos end point to be polluted with random errors.

     

     

  • 0 in reply to Navar Holmes

    Hello Navar Holmes,

    these errors aren't normal.
    Apparently they can be "reliably reproduced". I'd open a ticket with Support as it should be possible to get closer to the actual cause but this requires some specific tracing.

    Christian

  • 0 in reply to QC

    I have opened a ticket with support, and they are telling me to supress it, after many months of more logs and trying different things, I'm not sure that supressing the error, is the smartest thing to do. but I'm spending so much time on this, it needs to end, I'm being to told that the error cant be reproduced and it is transient, so supressing it is the way to go.

     

Unfiltered HTML