Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos AV update failed - broken all web access when malware enabled - This keeps happening

I have had this problem a few times before, and the only way I've been able to fix it is to completely re-image the device and restore from backup.  Until this issue is fixed, there must be an easier way.

 

This has been shown in a previous thread - https://community.sophos.com/products/xg-firewall/f/sophos-xg-firewall-general-discussion/86815/proxy-broken-with-latest-malware-av-pattern-update---lost-all-web-access/321434#321434

 

I have malware enabled on my FW rule to handle endpoints, using the sophos engine.  Sometimes the sophos AV pattern update fails.  When this happens, it breaks access to the web, with the proxy returning a 500 response to all requests.

If I remove malware checking from the FW rule and/or change the malware engine - it fixes web access.   However, I cannot get the sophos AV to update, and thus remains broken.

 

I am currently on SFOS 16.05.0 GA

The most recent patten update showing the following....

Sophos AV
1.0.10583
-
20:56:17, Mar 02 2017
Failed

This is the tail from the up2date_av.log

2017-03-05 04:56:31 AM: applying incremental update update
2017-03-05 04:56:31 AM: updating /sdisk/savi/engine signatures
2017-03-05 04:56:31 AM: updating /sdisk/savi/vdl signatures
2017-03-05 04:56:33 AM: New savi full update Failed
2017-03-05 06:56:31 AM: Got the lock for updating savi (savi_10576-10596.tar.gz
)
2017-03-05 06:56:31 AM: applying incremental update update
2017-03-05 06:56:31 AM: updating /sdisk/savi/engine signatures
2017-03-05 06:56:31 AM: updating /sdisk/savi/vdl signatures
2017-03-05 06:56:33 AM: New savi full update Failed
2017-03-05 08:56:31 AM: Got the lock for updating savi (savi_10577-10597.tar.gz
)
2017-03-05 08:56:31 AM: applying incremental update update
2017-03-05 08:56:31 AM: updating /sdisk/savi/engine signatures
2017-03-05 08:56:31 AM: updating /sdisk/savi/vdl signatures
2017-03-05 08:56:34 AM: New savi full update Failed
2017-03-05 10:56:31 AM: Got the lock for updating savi (savi_10577-10597.tar.gz
)
2017-03-05 10:56:31 AM: applying incremental update update
2017-03-05 10:56:31 AM: updating /sdisk/savi/engine signatures
2017-03-05 10:56:31 AM: updating /sdisk/savi/vdl signatures
2017-03-05 10:56:33 AM: New savi full update Failed
2017-03-05 12:56:30 PM: Got the lock for updating savi (savi_10577-10597.tar.gz
)
2017-03-05 12:56:30 PM: applying incremental update update
2017-03-05 12:56:30 PM: updating /sdisk/savi/engine signatures
2017-03-05 12:56:31 PM: updating /sdisk/savi/vdl signatures
2017-03-05 12:56:33 PM: New savi full update Failed

 

Is there a way to clear the current AV pattern so it can update, without the need to reinstall the image????  This happens at least once a month and is causing real issues.

 

Any help greatly appreciated.

 



This thread was automatically locked due to age.
Parents Reply Children
No Data