Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 8 replies
  • Subscribers 1 subscriber
  • Views 4950 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Update over HTTP through Forefront TMG

Arcesilaus

Currently testing Sophos 9.7, I've setup a CID to be available over HTTP, published through MS Forefront TMG.

It has been working fine for almost a month, but suddenly my test "remote" client returned errors.

In short:

  • The client finds the remote CID to be corrupted ("CIDSYNC_E_RCIDERROR (Remote CID is corrupted.) " 
  • It then starts to look for the "/catalogue/sdds.esc97.xml " file, which does not exist
  • Sophos update fails 

Interestingly enough, this only happens when downloading through the Forefront TMG: when connecting to the same resource (i.e.: updates.domain.local), there is no problem.

The remote client's log reads:

Trace(2011-Sep-02 10:22:31): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Calling SyncProduct with {E17FE03B-0501-4aaa-BC69-0129D965F311}
Trace(2011-Sep-02 10:22:31): CIDUpdateLocation::SyncProduct - Updating Product: SAVXP
Trace(2011-Sep-02 10:22:31): CIDUpdate(SyncProduct.Start): SAVXP, http://updates.domain.com/antivirus/xp/
Trace(2011-Sep-02 10:22:31): CIDUpdateLocation::Sync - Updating from http CID: http://updates.domain.com/antivirus/xp/savxp
Trace(2011-Sep-02 10:22:31): CIDSync(CidSyncMessage): 
Trace(2011-Sep-02 10:22:33): CIDSync(CidSyncMessage): svf.xml
Trace(2011-Sep-02 10:22:33): CIDSyncCallback, SynchronisationTerminated - Code = -2147217663
Trace(2011-Sep-02 10:22:33): CIDSyncCallback, SynchronisationTerminated - MapFile = C:\ProgramData\Sophos\AutoUpdate\cache\savxp.map
Trace(2011-Sep-02 10:22:33): CIDUpdateLocation::SyncProduct: Failed to update product (SAVXP) from "http://updates.domain.com/antivirus/xp/", Error is :CIDSYNC_E_RCIDERROR (Remote CID is corrupted.)
Trace(2011-Sep-02 10:22:33): CIDUpdate(CIDDownloadFailed): SAVXP, http://updates.domain.com/antivirus/xp/
Trace(2011-Sep-02 10:22:34): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, SyncProduct returned - 0
Trace(2011-Sep-02 10:22:34): TrySyncProduct<class AutoUpdate::CIDUpdateLocation>, Ended - 0
Trace(2011-Sep-02 10:22:34): TrySyncProduct<class AutoUpdate::SDDSUpdateLocation>, Started: 
Trace(2011-Sep-02 10:22:34): TrySyncProduct<class AutoUpdate::SDDSUpdateLocation>, creating update location
Trace(2011-Sep-02 10:22:34): Path to decode files to: C:\Windows\TEMP\sophos_autoupdate1.dir\1314951754
Trace(2011-Sep-02 10:22:34): Using top level catalogue sdds.esc97
Trace(2011-Sep-02 10:22:34): SDDSUpdateLocation, constructor start
Trace(2011-Sep-02 10:22:34): locConfig.m_server = http://updates.domain.com/antivirus/xp/
Trace(2011-Sep-02 10:22:34): Calling check on source.m_address.m_path = http://updates.domain.com/antivirus/xp/
Trace(2011-Sep-02 10:22:34): Calling package_source_init
Trace(2011-Sep-02 10:22:34): Creating package source to represent parent
Trace(2011-Sep-02 10:22:34): Create package source to represent local cache
Trace(2011-Sep-02 10:22:34): SDDSUpdateLocation::Constructor finished
Trace(2011-Sep-02 10:22:34): TrySyncProduct, Calling BeginSync
Trace(2011-Sep-02 10:22:34): SDDSUpdateLocation caught exception from BeginSync: Cannot create stream http://updates.domain.com/antivirus/xp/catalogue/sdds.esc97.xml GetLastError returned 0
Trace(2011-Sep-02 10:22:34): TrySyncProduct<class AutoUpdate::SDDSUpdateLocation>, Ended - 0

Is there anyone who can provide me any details on the "CIDSYNC_E_RCIDERROR " error and the "catalogue/sdds.esc97.xml " file?

Thank you very much!

:16117


This thread was automatically locked due to age.
  • 0

    Can you check all the MIME types are correct.  The article below was updated recently and the extension .bd2  was added.

    http://www.sophos.com/support/knowledgebase/article/61560.html

    :16125

     - - - - - - - - - - - -

    Communities Moderator, SOPHOS
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0

    Thank you for your quick reply.

    I've added the missing MIME type, but to no avail. To be honest, I did not expect it to make a difference, since updating directly from IIS works, but not through an ISA or TMG server.

    That is to say: it seems regular IDE updates work fine, but some stronger update, such as any engine update, fails.

    After emptying the cache, the log shows:

    Trace(2011-Sep-02 22:14:20): CIDSync(CidSyncMessage): vdl07.vdb
Trace(2011-Sep-02 22:14:20): CIDSync(CidSyncMessage): program files\Sophos\Sophos Anti-Virus\TamperProtectionControl.dll
Trace(2011-Sep-02 22:14:20): CIDSync(CidSyncMessage): CommonAppData\Sophos\Sophos Anti-Virus\Config\bootstrap.xml
Trace(2011-Sep-02 22:14:20): CIDSyncCallback, SynchronisationTerminated - Code = -2147217663
Trace(2011-Sep-02 22:14:20): CIDSyncCallback, SynchronisationTerminated - MapFile = C:\ProgramData\Sophos\AutoUpdate\cache\savxp.map
Trace(2011-Sep-02 22:14:20): CIDUpdateLocation::SyncProduct: Failed to update product (SAVXP) from "http://updates.domain.com/antivirus/xp/", Error is :CIDSYNC_E_RCIDERROR (Remote CID is corrupted.)
Trace(2011-Sep-02 22:14:20): CIDUpdate(CIDDownloadFailed): SAVXP, http://updates.domain.com/antivirus/xp/

    Any clue?

    :16129
  • 0

    HI,

    Have you tried removing the CID and letting SUM re-create it?

    Also is it right that only one client is failing in this way?  I wonder if the error might be due to a local problem on the client and the CID perhaps means the local cache in this context? 

    As a test, delete the CID, let SUM re-create it.  Try an update now, if the same problem, delete on the client the "contents" of "C:\ProgramData\Sophos\AutoUpdate\cache\" and delete: "C:\ProgramData\Sophos\AutoUpdate\data\status \status.xml" and let the client update.  Does that help?


    Jak 

    :16137
  • 0

    Thanks for the suggestions.

    I've removed the CID and recreated it.

    I've also emptied the cache on the client and removed the status file.

    It is correct that only clients that connect through Forefront TMG (ISA server) fail: updating over LAN is succesful.

    Therefore maybe I should rephrase my question: what is specific for engine updates -compared to definition updates- that could be blocked by a firewall?

    :16143
  • 0

    Hello Arcesilaus,

    could you resolve your problem? If not - it looks like the error occurs when the bootstrap.xml file is downloaded. Could it be that TMG somehow fiddles with its contents?

    Christian

    :16487
  • 0

    Hi QC

    Please accept my apologies for the late reply: I was away for a week (only week of leasure this year) and I am currently in a intense educational program (non-IT), so time to investigate this any further has been limited.

    I've posted the issue also on the TMG forum, since it seems the issue lies with the TMG machine, not with Sophos.

    I will hint at the way the XML file is treated in that thread and report back here as soon as I've got a clue and/or solution.

    :16849
  • 0

    Update:

    It looks like the XML file was indeed the problem.

    Looking at the log files in TMG, I found that the XML file, together with the TEXT files, were not labeled as MIME-type "application/Sophos-X". 

    As a consequence, the files were compressed, since HTTP compression was enabled.

    SUM cannot perform decompression, so the file was not recognized.

    Having turned off the compression, it works again!

    I need to confirm with remote clients, but it looks promising. 

    As soon as I am sure the solution works, I will confirm here and mark the post as solved.

    For now, thank you very much for the golden tip!

    :16857
  • 0

    HI There,

    I have exactly the same issue as you but I don't seem to be able to get round it. Is it possible to share how you configured your publishing rule in TMG as I am getting a web proxy chaining error.

    If you could help me out that would be really appreciated my email is jamie.cox@cnlsoftware.com.

    Many thanks in advance

    Jamie

    :24031
Cookie Information Banner