Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 8 replies
  • Subscribers 1 subscriber
  • Views 4304 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Child server not updating from parent

Jun

hi,

One of my child server is no longer updating from my parent server. No errors was found it's just that the last updated status was stuck to 2/25/2011 8:14:01pm. I tried to manual update it by right clicking and click on update now but still the same. I'm using enterprise console 4.5

Has anybody encountered this issue? Please share a possible work around or fix on this if you have.

Thanks

:9753


This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    It would be worth tracing the status message from the SUM to the management server.  The Sophos Agent service on the SUM machine talks to SUM by using a socket.  I,e, the Sophos Agent connects to TCP 51234 of SophosUpdateMgr.exe.

    Can we check this is happening first?  

    To do so, I would:

    1. Stop the Sophos Agent Service and the Sophos Update Manager service on the SUM machine.

    2. Ensure that the process SophosUpdatemgr.exe is no longer running

    3. Start the Sophos Update Manager Service

    4. Start the Sophos Agent Service

    5. In the newly created Sophos Agent log (C:\programdata\Sophos\Remote Management System\3\Agent\Logs\) on the SUM machine you should see when the Agent Starts up the lines:

    I SDDM:SCAPI: Connect succeeded.
    I SDDMA: Logon key written successfully.
    I SDDMA: Logon key sent.
    I SDDMA: Socket connection authenticated.
    I SDDMA: The adapter is connected to SDDM.

    This should then be followed with XML which describes the status of the SUM.  You should see UNC paths and timestamps for "lastNonNullFinishedAt" etc.. Basically something that looks like a message from SUM.  This will be followed up with a:

    I SendStatus: Sent EM-GetStatus-Reply (id=[MESSAGEID]) to EM

    You should be able to find this entry in the Router logs (C:\programdata\Sophos\Remote Management System\3\Router\Logs\) of the SUM machine.  E.g.

    I Routing to EM: id=[MESSAGEID], origin=Router$p4.Agent, dest=EM, type=EM-GetStatus-Reply

    I Sent message (id=[MESSAGEID) to EM

    EM is essentially the address of the management server.

    From there it's over to the management server, you should be able to see the EM-GetStatus-Reply message in the Router logs of the server and from there identify the lines in the sophos-management-services.log file (C:\programdata\Sophos\Sophos Endpoint Management\4.7\log\) that correspond to processing the message.


    If the message is getting this far, it should only be one more short step into the database.

    As the last message time of the machine is recent, this would suggest RMS is ok, so it's either that the status of the SUM is not being included at the start, in which case checking the above should help verify it is.

    Regards,

    Jak

    :9815
Reply
  • 0

    Hi,

    It would be worth tracing the status message from the SUM to the management server.  The Sophos Agent service on the SUM machine talks to SUM by using a socket.  I,e, the Sophos Agent connects to TCP 51234 of SophosUpdateMgr.exe.

    Can we check this is happening first?  

    To do so, I would:

    1. Stop the Sophos Agent Service and the Sophos Update Manager service on the SUM machine.

    2. Ensure that the process SophosUpdatemgr.exe is no longer running

    3. Start the Sophos Update Manager Service

    4. Start the Sophos Agent Service

    5. In the newly created Sophos Agent log (C:\programdata\Sophos\Remote Management System\3\Agent\Logs\) on the SUM machine you should see when the Agent Starts up the lines:

    I SDDM:SCAPI: Connect succeeded.
    I SDDMA: Logon key written successfully.
    I SDDMA: Logon key sent.
    I SDDMA: Socket connection authenticated.
    I SDDMA: The adapter is connected to SDDM.

    This should then be followed with XML which describes the status of the SUM.  You should see UNC paths and timestamps for "lastNonNullFinishedAt" etc.. Basically something that looks like a message from SUM.  This will be followed up with a:

    I SendStatus: Sent EM-GetStatus-Reply (id=[MESSAGEID]) to EM

    You should be able to find this entry in the Router logs (C:\programdata\Sophos\Remote Management System\3\Router\Logs\) of the SUM machine.  E.g.

    I Routing to EM: id=[MESSAGEID], origin=Router$p4.Agent, dest=EM, type=EM-GetStatus-Reply

    I Sent message (id=[MESSAGEID) to EM

    EM is essentially the address of the management server.

    From there it's over to the management server, you should be able to see the EM-GetStatus-Reply message in the Router logs of the server and from there identify the lines in the sophos-management-services.log file (C:\programdata\Sophos\Sophos Endpoint Management\4.7\log\) that correspond to processing the message.


    If the message is getting this far, it should only be one more short step into the database.

    As the last message time of the machine is recent, this would suggest RMS is ok, so it's either that the status of the SUM is not being included at the start, in which case checking the above should help verify it is.

    Regards,

    Jak

    :9815
Children
No Data