[SAV-LINUX] Notice from Sophos Anti-Virus on EVTSSVM

I got this notice from our Enterprise Console log.



[SAV-LINUX] Notice from Sophos Anti-Virus on EVTSSVM
An event happened on the computer EVTSSVM.

Update failed: Invalid checksum for base_os_upgrade/sav-sve-base-os-upgrade.tar.xz from \\ourserver\SophosUpdate\CIDs\S008
Failed to replicate from all update sources



I've googled the string "sophos update failed: invalid checksum" and "ssvm update failed: invalid checksum" and SURPRISINGLY nobody has said anything about his. Seems like such a generic message. But I am new to this whole thing so, maybe its something obvious. 

To me it looks like the .tar.xz file checksum is different than what is suspected and wasn't replicated to the shares. What do I do with this knowledge (or lack thereof)??

  • Hello Keith Franz,

    it could be a transient error or a glitch. I think the update cache of the SSVM is under /opt/sophos/ (or similar), might have /Primary/ in the path. You could try to locate the file there and compare it to the one on the CID. If a glitch it's safe to delete the contents of the applicable subfolder under \S008\ and let SEC/SUM rebuild the CID.


  • In reply to QC:

    Hi Christian,


    Thanks for your answer. Sorry, but it was a little bit cryptic for a newbie like myself but we were able to figure it out. I renamed the file specified with _BAK and then 

    go to Dashboard in the Sophos Enterprise Console > Update Managers pane > Right click Computer Name and View/Edit > Click Sources Tab > Select the soure location underneath > click Edit > Source Details shows the entry of this username

    **We have had to click change password and re-enter the password in the password field**
    **We think maybe because the file that holds this information got corrupt and needed re-written**



    After performing this, I went back into the Update Managers pane in the dashboard and right clicked the server and ran update now. 

    Hopefully this helps any other newbies out there.