Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 22 replies
  • Subscribers 1 subscriber
  • Views 49640 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

80040404 Threat detection data update failed.

tomerb

We have a central update manager that's providing updates for several local servers via http. The whole system worked fine until just a few weeks ago. I think the cause of the problem was the release of SEC 10.0.4, but I'm not sure about that.

The central update manager has the following subscriptions:

9.5 - recommended

9.7 - recommended

10.0 - recommended

The local severs have a full installation of SEC 5.0 and are subscribed to either 9.5 and 10.0 or 9.7 and 10.0.

A few weeks ago seemingly all local servers started issuing 80040404/80040401/80040406 error messages. I've tried the procedure described here

http://www.sophos.com/en-us/support/knowledgebase/66176.aspx

on central as well as local servers - no success.

I've "split" the subscription on the central server into 10.0.3 and 10.0.4 and tried either subscription on one of the local servers - no success.

Finally, I did a complete re-install on a test server (local server) and even that didn't help. Looking at the files I found out, though, that the Sxxx directories are completely missing on the local server whereas the Warehouse seems to be filled normally (~250MB).

Any suggestions?

:24987


This thread was automatically locked due to age.
Parents
  • 0

    So you have a central SEC/SUM, that is fine?  It's populating the warehouse directory and pushing to the distribution points?

    Yes, I'm fairly confident about that. SUM reports no errors at all and directories (Sxxxx) are created as expeted.

    The problem is just the "child" SUMs are failing to update from the shared out warehouse on the central server?

    That's true.

    What does the update manager trace log have in it when the "child" SUM tries to update from the parent?

    Now that's interesting! I'm getting a

    Failed to authenticate user for resource with host server. URL was:

    http://<server>/Warehouse/ec03188cd2c5bb12353ff926b32bc00bx000.dat

    When trying to access this particular file in a browser, I do get a password prompt. However, I can access most (possibly all - I've tried only a few) other files without getting one. I've never configured any kind of password authentication, because we don't need it and we wanted to keep things simple.

    As a quick and dirty solution I tried to supply credentials (tested in a browser - they work) but that doesn't change anything. However, at least I have an idea now where to look for things that are going wrong: The IIS configuration on the parent, which is btw a dedicated Windows 2003 Server.

    I'd still appreciate any other suggestions and I will come back as soon as I find out anything new.

    :25033
Reply
  • 0

    So you have a central SEC/SUM, that is fine?  It's populating the warehouse directory and pushing to the distribution points?

    Yes, I'm fairly confident about that. SUM reports no errors at all and directories (Sxxxx) are created as expeted.

    The problem is just the "child" SUMs are failing to update from the shared out warehouse on the central server?

    That's true.

    What does the update manager trace log have in it when the "child" SUM tries to update from the parent?

    Now that's interesting! I'm getting a

    Failed to authenticate user for resource with host server. URL was:

    http://<server>/Warehouse/ec03188cd2c5bb12353ff926b32bc00bx000.dat

    When trying to access this particular file in a browser, I do get a password prompt. However, I can access most (possibly all - I've tried only a few) other files without getting one. I've never configured any kind of password authentication, because we don't need it and we wanted to keep things simple.

    As a quick and dirty solution I tried to supply credentials (tested in a browser - they work) but that doesn't change anything. However, at least I have an idea now where to look for things that are going wrong: The IIS configuration on the parent, which is btw a dedicated Windows 2003 Server.

    I'd still appreciate any other suggestions and I will come back as soon as I find out anything new.

    :25033
Children
No Data