Sophos Endpoint Protection fails with checksum error

Question

Recently when installing Sophos Endpoint Protection from Sophos Central the install fails with checksum errors. Below are a few lines from the log file: 
 2018-01-25T14:39:58.7130318Z INFO : SUL info: [I19463] Syncing product SDU RECOMMENDED path=sdu 2018-01-25T14:39:58.7130318Z INFO : SUL info: [I19463] Product download size 4369571 bytes 2018-01-25T14:39:58.7130318Z INFO : Download size: 4369571 2018-01-25T14:39:58.7130318Z INFO : SUL info: [I19464] Syncing file 0ffc6f35d5af4f86f91dc62c10bfa782x000.dat: 4444 bytes: sdu/licenses.txt 2018-01-25T14:39:59.5100995Z INFO : SUL info: [I19464] File 0ffc6f35d5af4f86f91dc62c10bfa782x000.dat: sync failed 2018-01-25T14:39:59.5100995Z WARNING : SUL error: [E73342] Checksum error: 0ffc6f35d5af4f86f91dc62c10bfa782x000.dat: wrong size: saw 1, expected 4444 2018-01-25T14:39:59.5257289Z INFO : Command 'Download' completed with failure with reboot code '0' and error message 'Could not download software'. 2018-01-25T14:39:59.5257289Z ERROR : Installation failed. 2018-01-25T14:39:59.5257289Z INFO : Sending HTTP 'POST' request to: sophos/management/ep/install/events/endpoint/973ba348-402e-44b7-eb1e-60ee03209fcc 2018-01-25T14:39:59.5257289Z WARNING : WinHttpGetProxyForUrl returned: 12180 2018-01-25T14:39:59.5257289Z INFO : Attempting to connect using proxy '' of type 'Empty Proxy'. 
 
 I suspect the Watchguard firewall is causing this but I cannot pin it down. I have had Sophos and Watchguard involved but so far no luck, just finger pointing. 
 
 Any Ideas? 
 
 Ashley

jak · Accepted Answer

I see from the top of the log... 
 2018-01-25T19:44:32.2995681Z INFO : Analyzing whether to update from Sophos CDN or update cache 2018-01-25T19:44:32.2995681Z INFO : Checking access to update cache: aace-dc2.aace.com:8191 2018-01-25T19:44:32.2995681Z INFO : Updating configured to use: HTTPS 2018-01-25T19:44:32.2995681Z INFO : Update Cache Cert Path folder: C:\ProgramData\Sophos\Certificates\AutoUpdate\Cache 2018-01-25T19:44:32.3308283Z INFO : Successfully connected to cache 2018-01-25T19:44:32.3308283Z INFO : Cache response time: 26ms 2018-01-25T19:44:32.3308283Z INFO : Analysis complete - Using update cache: aace-dc2.aace.com:8191 2018-01-25T19:44:32.3308283Z INFO : Updating from cache: aace-dc2.aace.com:8191 2018-01-25T19:44:32.3308283Z INFO : Updating configured to use: HTTPS 2018-01-25T19:44:32.3308283Z INFO : Initial download: attempting to use bulk metadata 
 ... 
 then the failure, which is the same file. 
 2018-01-25T19:45:23.1331457Z INFO : SUL info: [I19464] Syncing file 0ffc6f35d5af4f86f91dc62c10bfa782x000.dat: 4444 bytes: sdu/licenses.txt 2018-01-25T19:45:23.9331678Z INFO : SUL info: [I19464] File 0ffc6f35d5af4f86f91dc62c10bfa782x000.dat: sync failed 2018-01-25T19:45:23.9331678Z WARNING : SUL error: [E73342] Checksum error: 0ffc6f35d5af4f86f91dc62c10bfa782x000.dat: wrong size: saw 1, expected 4444 2018-01-25T19:45:23.9486997Z INFO : Command 'Download' completed with failure with reboot code '0' and error message 'Could not download software'. 2018-01-25T19:45:23.9486997Z ERROR : Installation failed. 
 So the files are coming from an update cache - aace-dc2.aace.com:8191 
 Out of interest, what happens if you set the host file (C:\Windows\System32\drivers\etc\hosts) on a failing client to fail to resolve aace-dc2.aace.com. For example just set the host file to be something like: 
 10.1.1.2 aace-dc2.aace.com 
 Ensure that pining that location using ping aace-dc2.aace.com goes to the "new" address. Then trying to install, does it then go straight to Sophos and work? 
 Other option would be to firewall port 8191 on the update cache computer for a moment or disable the NIC or turn it off, etc... Just looking at: 
 https://community.sophos.com/kb/en-us/122577 
 I wounder if you can find the "corrupt" file in C:\ProgramData\Sophos\UpdateCache\www\warehouse\. Maybe you can delete it, clear the update cache somehow if this is the issue? Sorry I don't have one handy to try a few things. 
 Regards, 
 Jak