Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 7 replies
  • Subscribers 1 subscriber
  • Views 2780 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Enterprise Console 3.x - Upgrade Issues

kwy_tech

History:

I am a tech that recently took over control of the technology for a small private school.  I soon discovered that all of the Sophos products were outdated and that the automatic updates.  Most of the computer became infected with various viruses and I have spent a great deal of time working on the machines individually until I discovered we had Sophos Enterprise Console (SEC) on our single Windows 2003 Server.  I proceeded to upgrade the SEC from 3.x to 4.7 based on the instructions provided by the Sophos Upgrade Advisor.  The SEC is now at 4.7 but I have the following issues that I cannot seem to resolve no matter what I try.

Issue 1:

The "Migrate EMLibrary to SUM" procedure did not work for me during the upgrade process.  I have attempted to correct this based on various articles on the Sophos website but I just cannot figure it out.  I get the following warning every time I launch the SEC:  "EM Library is still running the updating hierarchy.  It is recommended that you migrate all your updating settings to Sophos Update Manager.  Click 'View Report' to view the 'Updating hierarchy' report of click 'OK' to close this dialog".  How do I correct this?

Issue 2:

I am unable to get any of the endpoint machines to update becuase I must not be configuring the SEC correctly.  I would like to have the machines pull updates directly from Sophos to avoid the issue of having outdated files on the server but I cannnot seem to get this to work.  When I update the address/URL in the Default Updating window the machines themselves append additional data to the end of the URL and the updates do not work.  What is the best practice for ensuring my machines stay updated?

Issue 3:

Post SEC upgrade I discovered that my C: drive on my server is nearly full now and there is nothing I can remove to free up any significant amount of space.  The Windows Server 2003 box only has an 8 Gig C: drive so I can in a bind now.  Would it be possible to remove all of the SEC product and put it on a Windows XP machine and manage my Sophos environment from another machine (note:  we only have one server and no budget at the moment so having a 2nd server is not an option).  Help!

:18611


This thread was automatically locked due to age.
  • 0

    Hello kwy_tech,

    let's start with space (3). Am I right to assume that the server has ONLY these 8 Gig? If SEC is up and running and has already successfully downloaded and deployed to the SuphosUpdate share (which I doubt, see: 2) it might "just" be enough space, as you can free up some 100M by removing EM Library. Considering a workstation as management server (which is in principle possible) - how many client computers?

    (2) You can't configure Sophos as the primary location but as Secondary (until you've sorted out your updating problems). I assume you are using a "new" policy, not a "Legacy" (if there is a tab Subscription it's a new one). The additional path (which is BTW not appended by the machines but by SEC) probably ends with SAVSCFXP and it's the equivalent of the CID location in EM Library. What is the error the clients encounter? If you could post a few lines from the updating log we might be able to help you figure out where the problem is.

    If you browse to the server's SophosUpdate share - do you see the folders \Warehouse and \CIDs, and under CIDs \S000\SAVSCFXP? Is the latter populated?

    (1) The warning is normal as long as you haven't completed the migration. Please run the report and post it here if it's not clear what it wants to tell you.

    Christian

    :18661
  • 0

    (3) Correct - the C: drive only has 8 Gig.  There is only about 500 Mb free.  So if I remove the EM library and configure the updates correctly then I can still manage the endpoinst with SEC - correct?  We have about 100 computers total online.  All are Windows XP with SP3.

    (2) Yes the "new" policy is on the system (there is a recommended Subscription listed).  You are correct about the items appended - it shows a CID location.  I will get a copy of the log and post it later.  I will check the SophosUpdate share let you know what I find when I post the log.

    (1)  ok.  I really appreciate your help!!!

    :18735
  • 0

    With 100 clients putting the management server on a workstation is out of the question (and officially it's no longer supported on XP). 

    The amount of data for the SAVXCFXP subscription is around 900MB currently (Warehouse, Working and CID). So if the new CID (under SophosUpdate) is already populated (some 850 files taking up 200+MB) it should continue to work for a while. Guess you have already removed the console (sfx) downloads. Of course it is also possible to store away at least the \pre-reqs subdirectory of \sec_47\ServerInstaller (if it's still on disk) which will free up additional 300+MB.

    Waiting for the log :smileyhappy:

    Christian

    :18747
  • 0

    we ran into similar issues. It was determined that it was far
    easier in the long run to migrate to a new server.  We built a new server up with the latest
    Endpoint console (at the time), re-created our policies, then did a re-install
    at the client using PS Tools and some home grown scripts (I would be happy to
    provide a source code if you need it). The we simply ran the script through our
    ORG remotely. It took about 2 days to complete and we could track the progress
    by watching the new server get its clients and the old server lose clients. We
    did about 3,800 total machines in two days (including reboots) with a success
    of about 99.21%. Since you only have about 100 clients you would be done in an
    hour or two (after server build of course). It turned out to be far quicker and
    we fought less issues in the long run. Next major release when we are ready for
    a new server we will likely do the same, until then we have plenty of space and
    power on the new server to do in place upgrades.

    :18753
  • 0

    I wish we had the budget right now to adopt your suggestion but I appreciate the feedback.  :smileyhappy:

    :18903
  • 0

    Sorry for the delay in posting.  It has been really busy lately.  Anyway - i tried to uninstall the SEC Library and the system cannot find the .msi file so it will not remove.  I did a search and found the Sophos EM Library .msi file but when I try to use it the system states it is corrupt and unusable.

    Here is the log...

    11/21/11 9:04 AM

    Updating Hierarchy

    Update managers, the shares they manage, and the groups updating from the shares.

    Report Description:

    Update managers

    Order in which sources are contacted

    Source of updates

    Update manager server name

    KWY1

    SOPHOS

     0

    Shares managed by update managers

    Update manager server name

    Share managed

    Computers using share as primary update server

    Computers using share as secondary update server

    http://es-web.sophos.com/update

     0

     0

    http://es-web-2.sophos.com/update

     0

     0

    http://Sophos

     0

     0

    KWY1

    \\KWY1\SophosUpdate

     0

     0

    Updating policies

    Share managed

    Policy name

    Update manager server name

    Used as

    KWY1

    \\KWY1\SophosUpdate

    http://es-web.sophos.com/update

    Primary location

    SAV Update

    http://es-web-2.sophos.com/update

    Secondary location

    SAV Update

    http://Sophos

    Primary location

    Default

    Groups using updating policies

    Policy name

    Group

    Number of computers in group

    Report prepared by

    1

    Updating Hierarchy

    Update managers, the shares they manage, and the groups updating from the shares.

    Report Description:

    Legacy updating policies

    Legacy policy that uses CID

    Central Installation Directory (CID)

    EM Library server name

    Used as

    KWY1

    \\KWY1\InterChk\ESXP

    Primary location

    Clients

    KWY1

    \\KWY1\InterChk\ESXP

    Primary location

    Servers

    http://Sophos

    Primary location

    Default

    http://www.tccsa.net/sophos/esxp

    Secondary location

    Clients

    http://www.tccsa.net/sophos/esxp

    Secondary location

    Servers

    Groups using legacy updating policies

    Number of computers in group

    Group

    Policy name

     0

    Default

     0

    Clients

    Clients

     3

    Clients\Classroom Computers

    Clients

     0

    Clients\Downstairs Lab

    Clients

     0

    Clients\Office Computers

    Clients

     1

    Servers

    Servers

    Report prepared by

    2

    :19053
  • 0

    I gave up waiting for assistance.  I deinstalled SEC from the server and will no longer manage the machines centrally.

    :19729