ML/PE-A Restored failed

Some users had a ML/PE-A event. I unblocked/allowed it.
Now they're getting multiple "Restored failed" event's every day. How do I resolve the "Restored failed"events?

  • Hi Barry

    Can you run the sophos diagnostic utility and post the zip for us to investigate further?

    You can run the diagnostic tool from the endpoint 

  • In reply to Karl_Ackerman:

    We have seen this on a one of our IT employee systems. (Love it when we dog food our own product).  It looks like in that instance the restore process was competing with some service stratup and scan services.

    We've since changed the timing so now there's a 5 minute wait (instead of 5 seconds) after the services start before rescanning the quarantine.  This means that if the PC was offline when the application is added to the allowed list then when the next starts up and connects to central we will wait ~5 min before attempting to restore files that are currently in quarantine.

    We found in our testing that doing the rescan too early was unreliable so I suspect this is the same issue.

    I believe the repeating "restore failed" messages have now been fixed elsewhere in the product.

    This will be fixed for general availability, but we would still like to get the SDU logs to confirm you were seeing the same issue as the one we fixed.

    Thanks

    KA

  • In reply to Barry Ralphs:

    Did you take a look at my logs? Was it the same issues? I'm still seeing the restore failed events.

  • In reply to Barry Ralphs:

    Engineering did investigate and they are confident this is related to the timing issue that will be resolved with the general available version.   Thanks for assisting us with this.