Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 13 replies
  • Subscribers 1 subscriber
  • Views 27051 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

succession of errors 0000006b and 00000000

AdrianR

actually 0000000 i snot an error.

So, the thing is that i have some over 100 clients and one SEC.

The problem i get is that there are always errors with 0000006b after, in the first care, the client returned 00000000 - which means update successful.

Firstly, i don't know what to believe. is it updated or not? because the 00000000 success is followed after 10  minutes by 0000006b and then after 10 minutes, again 00000000 (success) and then after another 10 min 0000006b. lik here

                                           5/30/2014 8:23:20 AM 00000000  Updated successfully                    
                                           5/30/2014 8:13:25 AM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                           5/30/2014 8:03:20 AM 00000000  Updated successfully                    
                                           5/30/2014 7:53:30 AM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                           5/30/2014 7:43:20 AM 00000000  Updated successfully                    
                                           5/30/2014 7:33:24 AM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                           5/30/2014 7:23:26 AM 00000000  Updated successfully                    
                                           5/30/2014 7:13:23 AM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                           5/30/2014 7:03:20 AM 00000000  Updated successfully                    
                                           5/30/2014 6:53:34 AM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                           5/30/2014 6:43:20 AM 00000000  Updated successfully                    
                                           5/30/2014 6:33:35 AM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                           5/30/2014 6:23:20 AM 00000000  Updated successfully                    
                                           5/30/2014 6:13:34 AM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                           5/30/2014 6:03:19 AM 00000000  Updated successfully                    
                                           5/30/2014 5:53:34 AM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\

Secondly, why does this occur?

I tested telnet for 8192 and 8194 and it works bothways (client -> SEC / SEC -> client)

Is there anything that i am missing here?

:50940


This thread was automatically locked due to age.
  • 0

    Hello AdrianR,

    could you post a snippet - one failed and one success cycle - of the corresponding ALUpdate log from one of the endpoints (in %ProgramData%\Sophos\AutoUpdate\Logs)? Looks like a successful update causes the next one to fail, the logs might give a hint.

    Protection is not affected - this applies to the AutoUpdate component (i.e. AutoUpdate potentially updating itself), not SAVXP (or RMS for that matter, which is not at all involved here - this is not a communication/reporting problem).

    Christian

    :50944
  • 0

                        
                                               6/11/2014 4:10:04 PM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/11/2014 4:01:26 PM 00000000  Updated successfully                    
                                               6/11/2014 3:56:35 PM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/11/2014 3:52:50 PM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/11/2014 3:41:40 PM 00000000  Updated successfully                    
                                               6/11/2014 3:32:45 PM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/11/2014 3:21:58 PM 0000006b  Download of RMSNT failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/11/2014 2:52:32 PM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/11/2014 2:47:34 PM 00000000  Updated successfully                    
                                               6/11/2014 2:42:41 PM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/11/2014 2:31:40 PM 00000000  Updated successfully                    
                                               6/11/2014 2:22:32 PM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/11/2014 2:11:40 PM 00000000  Updated successfully                    
                                               6/11/2014 2:02:32 PM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/11/2014 1:51:46 PM 00000000  Updated successfully                    
                                               6/11/2014 1:42:36 PM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/11/2014 1:31:40 PM 00000000  Updated successfully                    
                                               6/11/2014 1:22:31 PM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/11/2014 1:11:40 PM 00000000  Updated successfully                    
                                               6/11/2014 1:02:32 PM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
        

    check attached file

    :50952
  • 0

    Hello AdrianR,

    this ALUpdate log covers a different interval. It looks like a reinstall has been done, all update attempts but one (at 17:32:41) failed with Source not found, which in turn was the result of CIDUpdate(Info): \\SEC-P02\SophosUpdate, srv.sophos, 1326. 1326 is ERROR_LOGON_FAILURE  The user name or password is incorrect. There's no indication that just downloading AutoUpdate failed.

    Christian

    :50978
  • 0

    i pushed the client towards the machine once again to hope solving it. still.. the same

    Sophos AutoUpdate status                Date/time            Code      Description                             
                                               6/12/2014 11:35:34 AM0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/12/2014 11:25:32 AM00000000  Updated successfully                    
                                               6/12/2014 11:15:38 AM0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/12/2014 11:05:24 AM00000000  Updated successfully                    
                                               6/12/2014 10:56:27 AM00000000  Updated successfully                    
                                               6/12/2014 10:46:34 AM0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/12/2014 10:36:26 AM00000000  Updated successfully                    
                                               6/12/2014 10:26:33 AM0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/12/2014 10:16:25 AM00000000  Updated successfully                    
                                               6/12/2014 10:06:34 AM0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/12/2014 9:56:24 AM 00000000  Updated successfully                    
                                               6/12/2014 9:46:32 AM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/12/2014 9:36:24 AM 00000000  Updated successfully                    
                                               6/12/2014 9:26:32 AM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\
                                               6/12/2014 9:16:23 AM 00000000  Updated successfully                    
                                               6/12/2014 9:06:37 AM 0000006b  Download of Sophos AutoUpdate failed from server \\SEC-P02\SophosUpdate\CIDs\S000\SAVSCFXP\

    these are from today, same porblem.

    I don't get it.

    I rechecked the password in the update policy. the policy was successfully applied to the machine. Still get this error.

    Then i re pushed the client so to be sure it's with the good password, same issue.

    Thank you.

    :50986
  • 0

    Hello AdrianR,

    could you please attach the ALUpdate log which correlates with (part of) the updating log posted here (i.e. at least half an hour between 6:00 and 11:30 today). BTW: Is \\SEC-P02\SophosUpdate\ a share on a single server?

    Christian

    :50988
  • 0

    Thanks, AdrianR

    I now see that the Download of Sophos AutoUpdate failed is somewhat misleading - all downloads fail. Every second run there's the 1326 for user srv.sophos. Assuming the clocks on the endpoint and the server are synchronized I'd check the Security Event log on the server (using the timestamp from the 1326 messages). I have no idea (which withstands scrutiny) what could cause this behaviour. 

    Christian

    :51000
  • 0

    yes, time is sync'ed :(

    the srv.sophos password was put in place either in th epolicy ( and pushed) and i also tried with command:

    UpdateManagerHelper -c computerName username password -nowarn

    still, i can't get it..

    :51016
  • 0

    Hello AdrianR,

    time is sync'ed

    I've mentioned it because you should check the Windows Security Event log on the server whether failed Logons or Credential Validations are recorded for the times AutoUpdate reports the 1326 error (and for other workstations as well). Does this happen for all clients or only some of them?

    In order to get some idea what is happening I'd change the update interval first to 5 minutes to see if it produces the same pattern (fails-succeeds-fails-) and then to at least 20.

    Christian

    :51018
  • 0

    I tried to find this setting, where to set it 5.. 20 minutes.

    can you give me a hint :) ?

    thank you

    :51200