Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 22 replies
  • Subscribers 1 subscriber
  • Views 49654 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

80040404 Threat detection data update failed.

tomerb

We have a central update manager that's providing updates for several local servers via http. The whole system worked fine until just a few weeks ago. I think the cause of the problem was the release of SEC 10.0.4, but I'm not sure about that.

The central update manager has the following subscriptions:

9.5 - recommended

9.7 - recommended

10.0 - recommended

The local severs have a full installation of SEC 5.0 and are subscribed to either 9.5 and 10.0 or 9.7 and 10.0.

A few weeks ago seemingly all local servers started issuing 80040404/80040401/80040406 error messages. I've tried the procedure described here

http://www.sophos.com/en-us/support/knowledgebase/66176.aspx

on central as well as local servers - no success.

I've "split" the subscription on the central server into 10.0.3 and 10.0.4 and tried either subscription on one of the local servers - no success.

Finally, I did a complete re-install on a test server (local server) and even that didn't help. Looking at the files I found out, though, that the Sxxx directories are completely missing on the local server whereas the Warehouse seems to be filled normally (~250MB).

Any suggestions?

:24987


This thread was automatically locked due to age.
Parents
  • 0

    Hello Thomas,

    haven't upgraded to 5.1 yet but I see that the Beta has also SUM version 1.3.1.168. 

    I must admit I have been dense - I've missed that you said: The local severs have a full installation of SEC 5.0. I do think that updating from a Warehouse provided by a "downlevel" SEC (even if the SUMs have the same version) might cause problems.

    2DE69C24 -....  is, BTW, a folder in the warehouse and belongs to Patch. It should contain an XML file (70d5a8cb97e2...) - that's what your SUMs are looking for. Obviously the 5.0 servers can find what they are looking for. If there is an XML file (and only one) but with a different name ... 

    Can't say in which way the Warehouse depends on the SEC/SUM downloading it - but it is not the "complete" Warehouse you'll find at the Sophos server. If the XML file in the 2DE69C24 - folder has a different name and you don't care digging a little try the following: Look at sdds.local.xml in the \Warehouse\catalogue folder on a 5.0 and a 5.1 child.  The <md5> hex-char string in <file> names an XML file you'll find in the Warehouse base. This file in turn has an entry with rigidName 2DE69C24 - ... and its <md5> names the file (which fails synchronization on the 5.1 servers). If all 5.0 servers have the same name here but the 5.1 ones another this suggests that they expect a different Warehouse content.

    Most of this is just guesswork though

    Christian

    :25591
Reply
  • 0

    Hello Thomas,

    haven't upgraded to 5.1 yet but I see that the Beta has also SUM version 1.3.1.168. 

    I must admit I have been dense - I've missed that you said: The local severs have a full installation of SEC 5.0. I do think that updating from a Warehouse provided by a "downlevel" SEC (even if the SUMs have the same version) might cause problems.

    2DE69C24 -....  is, BTW, a folder in the warehouse and belongs to Patch. It should contain an XML file (70d5a8cb97e2...) - that's what your SUMs are looking for. Obviously the 5.0 servers can find what they are looking for. If there is an XML file (and only one) but with a different name ... 

    Can't say in which way the Warehouse depends on the SEC/SUM downloading it - but it is not the "complete" Warehouse you'll find at the Sophos server. If the XML file in the 2DE69C24 - folder has a different name and you don't care digging a little try the following: Look at sdds.local.xml in the \Warehouse\catalogue folder on a 5.0 and a 5.1 child.  The <md5> hex-char string in <file> names an XML file you'll find in the Warehouse base. This file in turn has an entry with rigidName 2DE69C24 - ... and its <md5> names the file (which fails synchronization on the 5.1 servers). If all 5.0 servers have the same name here but the 5.1 ones another this suggests that they expect a different Warehouse content.

    Most of this is just guesswork though

    Christian

    :25591
Children
No Data