Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 9 replies
  • Subscribers 1 subscriber
  • Views 296273 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SEC v5.0.0.8 and Sophos Web Intelligence Update Service

toddh

Hey,

I had to do a reboot on our Sophos server over the weekend. Upon coming back up the system was complaining that there was a service that had failed to start. The service was the Sophos Web Intelligence Update Service.

Currently the "Startup Type" is set to "Automatic"

If I attempt to start the service manually, it starts and stops immediately and I get the Windows message stating this.

I am assuming that since the "Startup Type" is "Automatic" that this service should be in the "running" state.

I have checked the Windows Event Viewer and there is nothing logged there about the service.

I have also gone through the logs for Sophos and I haven't been able to find anything that might explain

why this service isn't starting.

Is there anything I can do to try and troubleshoot what the issue is? Or are there logs that perhaps I am missing that might reveal the issue?

Thank you

:21957


This thread was automatically locked due to age.
Parents
  • 0

    I think this performs the same tasks as swi_config.exe used to do based on the switches.  If you run:

    "C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe" /help  

    (64-bit machine) it shows you what the tool is capable of.  Looking at the service registration details under:

    "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\swi_update_64 "

    I see the "Group " is "Event Log " which makes it start very early on in start-up,  I guess this is why it is a service, to guarantee it runs early enough to do the neccessary unloading and loading of the LSP.  The Windows Internals books have a good section on startup and shutdown.  http://technet.microsoft.com/en-us/sysinternals/bb897416 also confirms how early it starts in relation to other services.

    Jak

    :21967
Reply
  • 0

    I think this performs the same tasks as swi_config.exe used to do based on the switches.  If you run:

    "C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe" /help  

    (64-bit machine) it shows you what the tool is capable of.  Looking at the service registration details under:

    "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\swi_update_64 "

    I see the "Group " is "Event Log " which makes it start very early on in start-up,  I guess this is why it is a service, to guarantee it runs early enough to do the neccessary unloading and loading of the LSP.  The Windows Internals books have a good section on startup and shutdown.  http://technet.microsoft.com/en-us/sysinternals/bb897416 also confirms how early it starts in relation to other services.

    Jak

    :21967
Children
No Data