Thread Info
  • Locked Locked
  • Replies 42 replies
  • Subscribers 27 subscribers
  • Views 34839 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[Sophos Notification] Sophos Central Endpoint and SEC: Computers fail/hang on boot after the Microsoft Windows April 9, 2019 update

Gowtham Mani

Hi Everyone,

After installing the following Microsoft Windows updates Sophos has received reports of computers failing to boot:

The issue is currently being investigated. For more updates and workaround, please follow the below KBA.

Following the Microsoft Windows 09th April update computers fail/hang on boot



This thread was automatically locked due to age.
Parents

  • We have noticed that since the new update has been rolled out, c:\ProgramData\Sophos\Autoupdate\data\status\AUAdapter.xml no longer exists. This is a problem as we monitor the contents of this file with our client monitoring systems (Solarwinds) to ensure that nothing untoward is going on with our customers AV and everything is up to date. Can you please advise how best to now do this since the file has been removed / retired?

    Example;

    Customer: *************
    Device: *************
    Device IP *************
    Service: Log Analysis (Batch) - c:\ProgramData\Sophos\Autoupdate\data\status\AUAdapter.xml
    State Transition: From Normal To Warning
    Time Of State Transition: 2019-05-15 09:11:56
    Notification: Priority 2 (0 mins – 24/7 Checks)

    Alert Trigger: difference in minutes between the last parsed dateline of the file and the local time of the test

    Service Details:
    File Size: 684.00 B
    Regular Expression 1: False
    Regular Expression 2: False
    Time Offset between Local Device and GMT: 1
    Difference in minutes between the last parsed dateline of the file and the local time of the test: 1.00 days
    Number of Lines in the File: 22.00 Lines
    File creation date: 2018-04-22 12:13:36
    File modification date: 2019-05-14 09:06:58
    Last Parse-able Date in Log (GMT): 2018-04-22 12:13:36
    The line count matched regex 1: 0.00 Lines
    The line count matched regex 2: 0.00 Lines

Reply

  • We have noticed that since the new update has been rolled out, c:\ProgramData\Sophos\Autoupdate\data\status\AUAdapter.xml no longer exists. This is a problem as we monitor the contents of this file with our client monitoring systems (Solarwinds) to ensure that nothing untoward is going on with our customers AV and everything is up to date. Can you please advise how best to now do this since the file has been removed / retired?

    Example;

    Customer: *************
    Device: *************
    Device IP *************
    Service: Log Analysis (Batch) - c:\ProgramData\Sophos\Autoupdate\data\status\AUAdapter.xml
    State Transition: From Normal To Warning
    Time Of State Transition: 2019-05-15 09:11:56
    Notification: Priority 2 (0 mins – 24/7 Checks)

    Alert Trigger: difference in minutes between the last parsed dateline of the file and the local time of the test

    Service Details:
    File Size: 684.00 B
    Regular Expression 1: False
    Regular Expression 2: False
    Time Offset between Local Device and GMT: 1
    Difference in minutes between the last parsed dateline of the file and the local time of the test: 1.00 days
    Number of Lines in the File: 22.00 Lines
    File creation date: 2018-04-22 12:13:36
    File modification date: 2019-05-14 09:06:58
    Last Parse-able Date in Log (GMT): 2018-04-22 12:13:36
    The line count matched regex 1: 0.00 Lines
    The line count matched regex 2: 0.00 Lines

Children
  • in reply to Richie Knight

    Hi Richie,

    Are you sure that the file no longer exists? Its still there on my machine. However, we have stopped writing to it, so this is likely the cause of the issue you see. Are you able to use the registry for this purpose? HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Sophos\AutoUpdate\UpdateStatus

    Regards,

    Stephen

  • in reply to StephenMcKay

    StephenMcKay said:

    Hi Richie,

    Are you sure that the file no longer exists? Its still there on my machine. However, we have stopped writing to it, so this is likely the cause of the issue you see. Are you able to use the registry for this purpose? HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Sophos\AutoUpdate\UpdateStatus

    Regards,

    Stephen

     

    Thanks Stephen. We shall take a look at the registry item you have mentioned and see how we can change our monitoring to accommodate.

Unfiltered HTML