Failed to install savxp: 1

Hi Berhad TA Securities Holdings,

Is this the complete error message?

Can you check the user "temp" folder for  Sophos Endpoint Bootstrap_[Timestamp].txt log & search for the keywords failed or return code and share the details here?

I only see 2017 (the day i install Sophos in this mechine) for Sophos Endpoint Bootstrap_[Timestamp].txt log in temp. I would post in the next reply if needed.

I found "failed" keywords in AutoUpdate log as per below :

2352.update_log_thread_104364.txt

This log for 30 - 31st August 2018. I believe it should be the same if you asking latest log. Sophos Central still showing "Failed to install savxp:1" in user event log.

Hi Berhad TA Securities Holdings,

2018-07-31T01:29:53.357Z [ 1280] [v5.11.141] WARN Failed to get the automatic proxy configuration. The error code was 12180.
2018-07-31T01:30:26.269Z [ 1256] [v5.11.141] ERROR CheckManifest: invalid package:invalid manifestPath:C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\sse64\manifest.dat result:1 dir:C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\sse64 file:.\osdp.dll expectedSize:486944 expectedSha1:e16dce39f53ca798523bfe96941e4200fec1b5b9 expectedSha256:7bfe2c0e4600a0f64f350179ee48730ae2cd610a47184789192db2110091a9ed
2018-07-31T01:30:26.269Z [ 1256] [v5.11.141] ERROR Failed to verify manifest in C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\sse64.
2018-07-31T01:30:26.405Z [ 1256] [v5.11.141] ERROR CheckManifest: invalid package:invalid manifestPath:C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp\manifest.dat result:1 dir:C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp file:.\ConfigureSAV.exe expectedSize:156456 expectedSha1:3a4954f91d3adfdef1210aec4ea2608fe584f713 expectedSha256:32c4ef5fccc21e54d9572dbe74e10a217e881463846f35fb51105444a9460145
2018-07-31T01:30:26.810Z [ 1256] [v5.11.141] ERROR Failed to verify manifest in C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp.

Is there any proxy configuration in the network?

Also, can you confirm if the following are allowed in the firewall:

Sophos Endpoint - domains

• *.sophos.com 
• *.sophosupd.com
• *.sophosupd.net
• *.sophosxl.net
• ocsp2.globalsign.com
• crl.globalsign.com
  
  

Sophos Endpoint - ports

• 80 (HTTP)
• 443 (HTTPS)

Yes we already allowed all in firewall and we didn't have any proxy. All Endpoint in the same network doesn't have this error. 

Hi TA ITD 

Diving into the logs submitted, There is a possibility of Controlled updates trying to pause the endpoint from Updating further (Looks like the Manifest files were cached and is not ready to accept the new versions downloads for components). Kindly please release controlled updates for the endpoint which is detailed in this KBA.

If turning OFF controlled updates do not seem to help you on this, The following can be tried to clear off the locally cached update files and retry downloading again.

Please go to C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp and manually install Sophos Anti-Virus.
Once installed please force an update.

If this is not fixing the issue please do the below after you disable tamper protection:

1. Press the Windows Key + R and type services.msc and press Enter.
2. Stop the Sophos AutoUpdate Service.
3. Rename the the following folders:
   
   C:\ProgramData\Sophos\AutoUpdate\Cache\decoded
C:\ProgramData\Sophos\AutoUpdate\data\warehouse

   to:
   
   C:\ProgramData\Sophos\AutoUpdate\Cache\old-decoded
C:\ProgramData\Sophos\AutoUpdate\data\old-warehouse
   
   
4. Delete the file SophosUpdateStatus.xml from the following folder:
   
   C:\ProgramData\Sophos\AutoUpdate\data\status
   
   
5. Start the Sophos AutoUpdate Service.
6. Open the Sophos Endpoint user interface.
7. Click About.
8. Click Update Now.
9. Once the update completes, click Refresh in ESH. The component should now display Installed.

Please do let me know if this helps in resolving the issue

Hi TA ITD 

Diving into the logs submitted, There is a possibility of Controlled updates trying to pause the endpoint from Updating further (Looks like the Manifest files were cached and is not ready to accept the new versions downloads for components). Kindly please release controlled updates for the endpoint which is detailed in this KBA.

If turning OFF controlled updates do not seem to help you on this, The following can be tried to clear off the locally cached update files and retry downloading again.

Please go to C:\ProgramData\Sophos\AutoUpdate\Cache\decoded\savxp and manually install Sophos Anti-Virus.
Once installed please force an update.

If this is not fixing the issue please do the below after you disable tamper protection:

1. Press the Windows Key + R and type services.msc and press Enter.
2. Stop the Sophos AutoUpdate Service.
3. Rename the the following folders:
   
   C:\ProgramData\Sophos\AutoUpdate\Cache\decoded
C:\ProgramData\Sophos\AutoUpdate\data\warehouse

   to:
   
   C:\ProgramData\Sophos\AutoUpdate\Cache\old-decoded
C:\ProgramData\Sophos\AutoUpdate\data\old-warehouse
   
   
4. Delete the file SophosUpdateStatus.xml from the following folder:
   
   C:\ProgramData\Sophos\AutoUpdate\data\status
   
   
5. Start the Sophos AutoUpdate Service.
6. Open the Sophos Endpoint user interface.
7. Click About.
8. Click Update Now.
9. Once the update completes, click Refresh in ESH. The component should now display Installed.

Please do let me know if this helps in resolving the issue

Great! This solved my problem.