Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 3234 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Client status: Up to date - unknown

QC

Just stumbled over a client with the value Unknown in the Up to date column. OS is WinXP SP3 German and latest patches, SAV 9.5.3 VDL 4.58G.

The client has just upgraded from 9.5.2 to 9.5.3 and the EM-DoAction (aka Update Computers Now from SEC) has no effect. The number of IDEs is one higher than it should be (116 vs. 115). There's no error in the logs and the AutoUpdate\Cache contents are correct (only 115 IDEs). There seems to be a left-over dloa-dck.ide in the %PROGRAMFILES%\Sophos\Sophos Anti-Virus folder (date modified Aug 11th, date created Sep 29th). 

I'll check if it's still there after the next update.

Christian

:5250


This thread was automatically locked due to age.
  • 0

    Hi,

    Did it remain after the next ide update, or did you have to delete it?

    If it's still there, is it listed in the savsync.upd file under \Program Files\Sophos\Sophos Anti-Virus\?

    I can understand why the machine is showing as "unknown" as when the status message was processed by the management service, it would have called the stored procedure PackageAdd which would have been unable to match any existing packages in the packages table with that IDEChecksum value, even though the ProductID, SAVVersion and VirusDataVersion would probably have matched.

    Are all other machines in that same group, and therefore using the same updating policy ok?

    Are the machines set with a primary and secondary location, if so, is there any chance that ide could have been pulled down from a secondary location?

    Did that machine switch to secondary for any reason, where as others in the same group did not?  The alc.log file might confirm this, if it goes back far enough?

    Is the secondary location created by the same SUM/EMLib? Is the secondary location Sophos? 

    I think this ide should have existed for 9.5.2 but not for 9.5.3 after looking at a couple of clients I have.

    Thanks,

    Jak

    :5260
  • 0

    Right, yak - the Unknown state is "correct" as far as it concerns SEC's logic. The IDE was definitely a left-over. It has not been fetched during the upgrade process, the upgrade was from the primary CID and the AutoUpdate\cache was in sync (therefore Update Computers Now did not correct the situation). As more or less expected with the next real update (i.e. when IDEs were added to the CID) the situation corrected itself. I had a second client (out of 200+) with the Unknown state on Friday, it too had just upgraded from 9.5.2 to 9.5.3 and this one had five(!) left-over IDEs. Again the next with the next real update the supernumerary IDEs disappeared.

    Looks like a minor glitch.

    Christian 

    [Edit:] Another one this morning - this time 135 instead of 133 IDEs (IDEs are not in savsync.upd, BTW)  

    :5262
  • 0

    Funny thing - have observed the same "problem" with the recent upgrade, several computers showing up to 13 extra IDEs. Seems to be caused by a failed first attempt to upgrade - when another installer is already active the upgrade quits (MSI has failed). While it succeeds at the next attempt for some reason a few IDEs from the previous version are not removed.

    Christian

    :17567