After MR7 , IPS Pattern fails to update 3.13.89

sachingurung, Aditya Patel can you have a look at this thread and issue with MR7-pattern update?

IPS seems not updating correctly. In my case I installed MR7 from scratch. WAF and Client Authentication agent patterns failed to update.

Thanks

Hi All,

Restart the IPS service manually from System Services | Services | IPS and then try "Update Pattern Now" from Back & Firmware | Pattern Updates. Alongside, please DM us the following logs and if anyone has a registered case# with the Support Team. Please refer, Sophos Firewall: Where to find log files.

1. u2d.log

2. csc.log 

3. Start debug log for IPS service before capturing the ips.log

Thanks

PM sent with logs.

Thanks

Hi,

restarted and no affect.

Will capture logs later.

ian

Just to add that Avira and Sophos patterns failed to updated. I restarted the system, and moved the U2DVERSION file to U2DVERSION_old under /content/avira and Avira updated successfully (because a new pattern was available).

The same trick did not work for savi, because there are no other new pattern. I will try tomorrow.

Sophos you should provide a way to force the download of the package in some way. Using commands, procedure of whatever. I formatted the XG and the behaviour is the same with pattern update process.

Something is broken inside MR7.

Thanks

Avira is dated 29/8/2017

Sophos and ATP are dated 28/8/2017

IPS is dated 24/8/2017

Ian

Does anyone in SOPHOS work on fixing the problems that the MR7 patch has?

The patch came out on Thursday, and today we have Tuesday...

I do not have to tell anyone how important IPS is in the company and the ability to send emails ;-)

Do you know what is the scale of the problem with these updates?

Have you logged a ticket with your reseller or Sophos support?

Ian

Just to inform that Sophos AV pattern is still downloading (from gui) while on /content/savi_new the pattern is updated.

Sophos AV 1.0.11425

Strange! I guess we need to wait for v17 beta and move to it in order to fix the issue.

Hello luk,

would not be a solution try to clean installation from ISO file, run the Pattern Updates and after these steps restore a configuration? The ISO MR7 is already available on the MySophos portal.

It is an idea, I do not know if it will work and if it is an acceptable solution because of reports, logs, etc.

I have one HW appliance and one vmware appliance and I did not even notice none of the reported problems with one of them (thank God).

alda