I can see the endpoint client connected and it seems to be working (ie.e latest definition and UTM is aware of it). However, I see random lines of logs where the endpoint can't talk to sophos liveconnect. I am not sure whether this is because of the end service but here are the logs:
The first one is about the fact that endpoint can't talk to liveconnect
sub="epsecd" name="Recieved report(s) from Sophos LiveConnect"
2012:06:27-00:13:08 **** epsecd[5052]: D Epsec::Utils::Logging::_log:59() => id="4230" severity="debug" sys="System" sub="epsecd" name="Updated ping information in the DB" mcs_id="6c534f21-c55b-9766-7d23-04951baa1e5e"
2012:06:27-00:13:08 **** epsecd[5052]: D Epsec::Utils::Logging::_log:59() => id="4211" severity="debug" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="116858"
2012:06:27-08:01:43 **** epsecd[5052]: D Epsec::Utils::Logging::_log:59() => id="4207" severity="debug" sys="System" sub="epsecd" name="Recieved report(s) from Sophos LiveConnect"
2012:06:27-08:01:43 **** epsecd[5052]: >=========================================================================
2012:06:27-08:01:43 **** epsecd[5052]: E id="4281" severity="critical" sys="System" sub="epsecd" name="Can't use an undefined value as an ARRAY reference at /Epsec/Helpers/Client.pm line 189." effect="Can't talk to Sophos LiveConnect"
2012:06:27-08:01:43 **** epsecd[5052]:
2012:06:27-08:01:43 **** epsecd[5052]: 1. Epsec::Utils::Logging::_log:59() /Epsec/Utils/Logging.pm
2012:06:27-08:01:43 **** epsecd[5052]: 2. Epsec::Logic::Client:[:$]n_error:1039() /Epsec/Logic/Client.pm
2012:06:27-08:01:43 **** epsecd[5052]: 3. Epsec::Logic::Base::run:60() /Epsec/Logic/Base.pm
2012:06:27-08:01:43 **** epsecd[5052]: 4. main::top-level:62() client.pl
2012:06:27-08:01:43 **** epsecd[5052]: id="4210" severity="debug" sys="System" sub="epsecd" name="Sleeping for 120 seconds"
2012:06:27-08:03:43 **** epsecd[5052]: D Epsec::Utils::Logging::_log:59() =
it then sleeps for a while ,re initiliase the database and it's up and running
2012:06:27-08:01:43 **** epsecd[5052]: D Epsec::Utils::Logging::_log:59() => id="4210" severity="debug" sys="System" sub="epsecd" name="Sleeping for 120 seconds"
2012:06:27-08:03:43 **** epsecd[5052]: D Epsec::Utils::Logging::_log:59() => id="4210" severity="debug" sys="System" sub="epsecd" name="Sleeping for 24 seconds"
2012:06:27-08:04:09 **** epsecd[5052]: I Epsec::Utils::Logging::_log:59() => id="4202" severity="info" sys="System" sub="epsecd" name="Run initialization database"
2012:06:27-08:04:11 **** epsecd[5052]: I Epsec::Utils::Logging::_log:59() => id="4247" severity="info" sys="System" sub="epsecd" name="Sending data to Sophos LiveConnect to sync UTM with the Broker"
2012:06:27-08:04:13 **** epsecd[5052]: D Epsec::Utils::Logging::_log:59() => id="4207" severity="debug" sys="System" sub="epsecd" name="Recieved report(s) from Sophos LiveConnect"
2012:06:27-08:04:13 **** epsecd[5052]: D Epsec::Utils::Logging::_log:59() => id="4230" severity="debug" sys="System" sub="epsecd" name="Updated ping information in the DB" mcs_id="6c534f21-c55b-9766-7d23-04951baa1e5e"
Greping the logs I can see that this is happening quite often
/var/log/epsecd/2012/05/epsecd-2012-05-31.log.gz:2012:05:31-00:29:02 **** epsecd[4991]: E id="4281" severity="critical" sys="System" sub="epsecd" name="Can't use an undefined value as an ARRAY reference at /Epsec/Helpers/Client.pm line 189." effect="Can't talk to Sophos LiveConnect"
/var/log/epsecd/2012/06/epsecd-2012-06-22.log.gz:2012:06:22-08:29:20 **** epsecd[5038]: E id="4281" severity="critical" sys="System" sub="epsecd" name="Can't use an undefined value as an ARRAY reference at /Epsec/Helpers/Client.pm line 189." effect="Can't talk to Sophos LiveConnect"
/var/log/epsecd/2012/06/epsecd-2012-06-23.log.gz:2012:06:23-07:32:44 **** epsecd[5052]: E id="4281" severity="critical" sys="System" sub="epsecd" name="Can't use an undefined value as an ARRAY reference at /Epsec/Helpers/Client.pm line 189." effect="Can't talk to Sophos LiveConnect"
/var/log/epsecd/2012/06/epsecd-2012-06-23.log.gz:2012:06:23-17:22:52 **** epsecd[5052]: E id="4281" severity="critical" sys="System" sub="epsecd" name="Can't use an undefined value as an ARRAY reference at /Epsec/Helpers/Client.pm line 189." effect="Can't talk to Sophos LiveConnect"
/var/log/epsecd/2012/06/epsecd-2012-06-23.log.gz:2012:06:23-22:23:01 **** epsecd[5052]: E id="4281" severity="critical" sys="System" sub="epsecd" name="Can't use an undefined value as an ARRAY reference at /Epsec/Helpers/Client.pm line 189." effect="Can't talk to Sophos LiveConnect"
/var/log/epsecd/2012/06/epsecd-2012-06-24.log.gz:2012:06:24-07:57:56 **** epsecd[5052]: E id="4281" severity="critical" sys="System" sub="epsecd" name="Can't use an undefined value as an ARRAY reference at /Epsec/Helpers/Client.pm line 189." effect="Can't talk to Sophos LiveConnect"
/var/log/epsecd/2012/06/epsecd-2012-06-24.log.gz:2012:06:24-18:04:34 **** epsecd[5052]: E id="4281" severity="critical" sys="System" sub="epsecd" name="Can't use an undefined value as an ARRAY reference at /Epsec/Helpers/Client.pm line 189." effect="Can't talk to Sophos LiveConnect"
/var/log/epsecd/2012/06/epsecd-2012-06-25.log.gz:2012:06:25-07:59:05 **** epsecd[5052]: E id="4281" severity="critical" sys="System" sub="epsecd" name="Can't use an undefined value as an ARRAY reference at /Epsec/Helpers/Client.pm line 189." effect="Can't talk to Sophos LiveConnect"
/var/log/epsecd/2012/06/epsecd-2012-06-25.log.gz:2012:06:25-19:55:40 **** epsecd[5052]: E id="4281" severity="critical" sys="System" sub="epsecd" name="Can't use an undefined value as an ARRAY reference at /Epsec/Helpers/Client.pm line 189." effect="Can't talk to Sophos LiveConnect"
/var/log/epsecd/2012/06/epsecd-2012-06-27.log.gz:2012:06:27-08:01:43 **** epsecd[5052]: E id="4281" severity="critical" sys="System" sub="epsecd" name="Can't use an undefined value as an ARRAY reference at /Epsec/Helpers/Client.pm line 189." effect="Can't talk to Sophos LiveConnect"
is that normal?
