Since recently, the MCS client is not able to communicate with sophos central. And the endpoints cannot be found in sophos central.
Tried this KB and everything is working just fine : https://community.sophos.com/kb/en-us/125463
Here are the logs in mcsclient.log
2020-07-06T13:47:36.546Z [ 8012] INFO Found new file: C:\ProgramData\Sophos\Management Communications System\Endpoint\Channels\EDR\Incoming\20200529T102201Z_2.dat
2020-07-06T13:47:36.546Z [ 8012] INFO Presigned urls have expired
2020-07-06T13:47:36.546Z [ 8012] INFO URL list expired
2020-07-06T13:48:33.078Z [ 8060] INFO [connect] trying server mcs-cloudstation-eu-central-1.prod.hydra.sophos.com/.../ep
2020-07-06T13:48:33.078Z [ 8060] INFO [connect: configured message relay] trying message relay <my_server_changed_for anonymizing>
2020-07-06T13:48:33.078Z [ 8060] INFO GET mcs-cloudstation-eu-central-1.prod.hydra.sophos.com:443/.../ep
2020-07-06T13:48:33.468Z [ 8060] INFO 200 : sent=0 rcvd=168 elapsed=389ms
2020-07-06T13:48:33.468Z [ 8060] INFO successfully connected to the message relay: <my_server_changed_for anonymizing>:8190
2020-07-06T13:48:33.468Z [ 8060] INFO [connect] using server mcs-cloudstation-eu-central-1.prod.hydra.sophos.com/.../ep via message relay <my_server_changed_for anonymizing>:8190 (peer address <my_server_changed_for anonymizing>)
2020-07-06T13:48:33.937Z [ 8060] INFO POST mcs-cloudstation-eu-central-1.prod.hydra.sophos.com:443/.../presignedurls
2020-07-06T13:48:35.062Z [ 8060] INFO 401 : sent=95 rcvd=0 elapsed=1120ms
2020-07-06T13:48:35.062Z [ 8060] INFO Dropping connection after error
2020-07-06T13:48:35.062Z [ 8060] ERROR Presigned url request failed, code: 401, message:
2020-07-06T13:48:35.062Z [ 8060] ERROR Failed to get URLs for channel TrickleFeedData, status: 401
I hope someone could help
This thread was automatically locked due to age.
