Clients updating directly from Sophos fail to update, a red cross is visible on the Sophos shield signifying a failed update

Hello Arnie,

fail to update can be a lot of things - among them: Failure to download any product, failure to download a specific product (for managed endpoints a  failure to download RMS is expected), or failure to install one or more components. What does the updating log say?

Christian

Hello Christian.
Is the answer I wrote arrived???
BR
/arnie

Hello Christian

THX for your replay.

The log says the same, as described in this article:
www.sophos.com/.../118470.aspx

ERROR: Could not find a source for updated packages
ERROR: Download of Sophos AutoUpdate failed from server Sophos

What we did and what we have:
- License is used in other Networks, too - without any Problems like this.
- It's a directly download from sophos, no Manager is used
- No firewalls are activated - not on the Workstations, not on the gateway (pls don't mess me - it's only for testing what might be the problem)
- No other AV is installed
- No maleware-scanner is installed
- Changeing the update-Server to one of the alternative URLs faieled with the same Errors (dci.sophosupd.com, d1.sophosupd.com, d2.sophosupd.com, d3.sophosupd.com, dci.sophosupd.net, d1.sophosupd.net, d2.sophosupd.net, d3.sophosupd.net)
- Ping to the alternative URLs are ok
- Tracert to the alternative URLs are ok
- Installation "as Administrator"
- Deinstallation and reinstallation - done
- Using the Workstation in another network - same errors.

HTH for finding a solution.

THX in advanced
BR /arnie

Hello Arnie,

alternative URLs won't work if you enter them instead of the generic Sophos location. So it's a "complete failure", the actual reason should be in the ALUpdate log. With the help of this article it shouldn't be too hard to find the relevant lines in the log, please post them here if necessary.

Christian

Hello Christian

In the log I found some interesting lines, but don't know how to fix it:
----------
...
UpdateLocationFacade::SyncProduct: Last Update Mechanism = Unknown

That's not good - ain't?

...
[I49502] Found supplement SDU LATEST
[I49502] Found supplement SXLSUP LATEST 2
[I49502] Found supplement VDL LATEST
[I49502] Found supplement HIPS LATEST
[I49502] Found supplement IDE521 LATEST
[I49502] Found supplement IDE522 LATEST
[I49502] Found supplement IDE523 LATEST
[I19463] Syncing product StandaloneWindows 40
ERROR: [E73342] Checksum error: b15e3a955dc3218a4c7cfae35224433a

Checksum Errors are mostly very bad - right?

...
ERROR: [E35364] Out of update sources
Synchronise failed: 4
Synchronisation state: 3
SDDS2Update(SDDS2DownloadFailed): ERROR: Download of Sophos Endpoint Security and Control failed from server sophos
TrySyncProduct<class SDDS2::SULUpdateLocation>, Calling SyncProduct with {E17FE03B-0501-4aaa-BC69-0129D965F311}
SULUpdateLocation: SyncProduct
Synchronise connected but failed.
TrySyncProduct<class SDDS2::SULUpdateLocation>, SyncProduct returned - 0
SULUpdateLocation: EndSync
TrySyncProduct<class SDDS2::SULUpdateLocation>, Ended - 0

These are too much error-messages
...
RMSMessageHandler: ALUpdateEnd
Sending message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSEndUpdate"><ErrorMessage><ID></ID><StringID>113</StringID><Sender>ALUpdate</Sender></ErrorMessage><ReadableMessage>FEHLER: Update-Quelle wurde nicht gefunden</ReadableMessage></Config>
IPCSender::Write: Writing message: <?xml version="1.0" encoding="utf-8" ?><Config type="RMSEndUpdate"><ErrorMessage><ID></ID><StringID>113</StringID><Sender>ALUpdate</Sender></ErrorMessage><ReadableMessage>FEHLER: Update-Quelle wurde nicht gefunden</ReadableMessage></Config>
IPCSender::ProcessSend: Listener not ready starting to wait
IPCSender::ProcessSend exiting

That's what is written in the protocol
----------

What I'm missing are lines like that if I compare with a logfile on a PC update's running and ok:

Adding product filter 'ssp'.
Adding product filter 'ntp64'.

Adding cache: C:\ProgramData\Sophos\AutoUpdate\cache\ssp
Adding cache: C:\ProgramData\Sophos\AutoUpdate\cache\ntp64

Any ideas? Did I give you the right lines?

BR and a big THANK YOU in advanced

/arnie

Hello Arnie,

Checksum Errors ain't good. Did I give you the right lines? These are likely all you could provide. I'm not sure about the displayed checksum - I assume it's an expected one. Can't verify this though as I don't have a stand-alone installation. If you can find the mentioned string (b15e...) in the file contained in %ProgramData%\Sophos\AutoUpdate\data\warehouse\catalogue\ then it's definitely an expected one ... mumble, mumble ... I'll spare you the details, The pragmatic approach is to empty (keep the folder)  %ProgramData%\Sophos\AutoUpdate\data\warehouse\ (and perhaps %ProgramData%\Sophos\AutoUpdate\cache\) and retry - this should either solve the issue or recreate the failed state.

Christian

Hello Christian

First: THX alot for your ideas.

It is strange - there is no Folder ...\catalogue
But I did what you said - deleted the content of the two folders (...\warehouse and ...\Cache).
It didn't solve the problem.

But something has worked: It recreates the failed state :-(

So - I think, I'll take a PC running SOPHOS with no problems and install it in the same network.
I am curious to see what happens.

Have a nice day and again - THX
/arnie

Hello Arnie,

there is no Folder ...\catalogue
but there is something in \warehouse? If the network (i.e. a network/gateway/firewall component) isn't the culprit you might want to check the MD5 of the downloaded files.

Christian

Hello Arnie,

there is no Folder ...\catalogue
but there is something in \warehouse? If the network (i.e. a network/gateway/firewall component) isn't the culprit you might want to check the MD5 of the downloaded files.

Christian