Dear readers and helpers,
We have a double issue with our Sophos Enterprise console 5.
1. I see only 5 computer connected instead of around 120.
2. Computers do not receive policies for Anti-virus and HIPS but receive for Firewall policies.
Where should i start investigating?
Thanks in advance,
Hello Pierre,
is this a fresh installation or did you upgrade from a previous version? How did you install on the clients?
Do I understand you correctly that only 5 show as connected and these 5 receive only the firewall policy? How did you find out? By checking the policies on the client or monitoring the status shown in SEC?
As for the clients not connected: What is their status in SEC? Are any fields filled in?
Christian
Dear Christian,
It has been upgraded from version 4.
It has been in production for 3 weeks and was fine until i leave it to someone else during my vacation ;^)
Clients have been deployed through the console. (AD environment)
Yes, i noticed discrepency between clients and the Anti-virus policy by checking on the clients VS policy.
In SEC clients are shown as disconnected computers. (most of them waiting policy transfer, firewall disabled)
After a reboot, clients are shown as connected, then few minutes later disconnected.
Any idea ?
Hello Pierre,
it could have been this someone else :smileywink:. You probably don't know if any changes have been made.
I'd take a look at the router logs ([%Alluserprofile%\Application Data\|%ProgramData%]\Sophos\Remote Management System\3\Router\Logs\ ) on a client, please post the next 20 or so lines after Sophos Messaging Router 3.4.0.2209 starting...
Christian
Yes it was from the server.
Here from one client :
Sorry for the delay, Pierre
In response to
13.01.2012 13:02:06 0BA4 I Getting parent router IOR from 192.168.1.41:8192
there should be one or more lines with the same tag (0BA4 ) talking about either preliminary success (Successfully validated parent router's IOR ) or failure. Could you please search for all the lines with the mentioned tag (0BA4 )?
Christian
No worries Christian.
Is this enough below ?
Enough in terms of relevant lines, yes (these are from the following day, right)? So the client can log on (therefore it should appear briefly as connected), receives some policies but subsequently encounters a problem when sending its status to the server (0B90 E Failed to send message (id=01115303) because of unknown exception, adding message back to queue ).
There should be a corresponding entry in the server's log (but it might have already wrapped after two days and be no longer available - in which case just try to recreate the problem).
On the client - are there any (many) files (xxxxxxxx.msg) in the ...\Remote Management System\3\Router\Envelopes folder? It might be worth a try to clear them (please see 63588 and 16336).
Christian
I cleaned as asked the envelopes folder on a client. No luck the computer is still disconnected.
Clients logs after the clean up :
