A child update manager shows the error 'Threat detection data update failed'

  • ID dell'articolo: 117736
  • Aggiornato: 06 mar 2014

Issue

In the console, on the 'Update managers' view, a child Sophos Update Manager (SUM) reports the following error:

Threat detection data update failed.

To confirm the exact issue you need to search the SUM trace logs.  The following error will be recorded in the trace logs for this issue:

  • Enterprise Console v5.2:
    Sync failure: Cannot create stream 7f8acc562fd796ba43e8dc4441ba0394x000.xml

  • Enterprise Console v5.1:
    Sync failure: Cannot create stream 70d5a8cb97e27fede48ab38eaf7c4ae7x000.xml

  • Enterprise Console v5.0:
    Sync failure: Cannot create stream a93e6923e800b4051baee85737714c2fx000.xml

This prevents SUM from downloading further data.

Note: You will not see this issue if running SEC4.x at the child level.

First seen in

Enterprise Console 5.0.0

Cause

The child SUM is updating from a parent where the versions of Sophos Enterprise Console (SEC) are different (e.g., the parent is running SECv5.1 and the child is running SECv5.0).

The xml file generating the error contains the Patch metadata file set. The xml files (listed in the 'Issue' section above) contain different file sets due to the changes made with each version of SEC.

When the child SUM updates and looks for the file specific to its own version it does not exist in the warehouse update location, causing the 'Sync failure' and logging the error in SUM.

What To Do

When the parent is SEC5.2 and the child is SEC5.1 or SEC5.0

  1. If Patch is not required at the child level
    1. Access the child machine
    2. Before you start ensure that you have read the warnings about editing the registry.
    3. Backup the following registry key:
      • For 32-bit systems this will be HKLM\SOFTWARE\Sophos\EE\Products\SophosPA\
      • For 64-bit systems this will be HKLM\SOFTWARE\Wow6432Node\Sophos\EE\Products\SophosPA\
    4. Delete the above registry key
    5. Access the 'Update Managers' view in Sophos Enterprise Console, right-click the Update manager Computer name and choose 'Update Now'.

  2. If Patch is required at the child level (requires Internet access and not supported in an air-gap environment), choose one of the following options appropriate to your set-up
    1. Update the child to SEC5.2 (recommended)
    2. Revert the parent to either SEC5.1 or SEC5.0
    3. Configure the child SUM to update directly from Sophos
    4. Install SEC5.1 or SEC5.0 at the parent level (on a new machine) configured with the same package configuration as the SEC5.2 install. Use this new SEC5.1 or SEC5.0 warehouse as the updating location for the child SUM(s).

Note: Modifying the SEC install by running Setup.exe will recreate the SophosPA registry key, requiring step 1 to be actioned again.

When the parent is SEC5.1 and the child is SEC5.0 or SEC5.2

  1. If Patch is not required at the child level
    1. Access the child machine
    2. Before you start ensure that you have read the warnings about editing the registry.
    3. Backup the following registry key:
      • For 32-bit systems this will be HKLM\SOFTWARE\Sophos\EE\Products\SophosPA\
      • For 64-bit systems this will be HKLM\SOFTWARE\Wow6432Node\Sophos\EE\Products\SophosPA\
    4. Delete the above registry key
    5. Access the 'Update Managers' view in Sophos Enterprise Console, right-click the Update manager Computer name and choose 'Update Now'.

  2. If Patch is required at the child level (requires Internet access and not supported in an air-gap environment), choose one of the following options appropriate to your set-up
    1. Update the child to SEC5.1 if the child is SEC5.0 (recommended)
    2. Revert the parent to SEC5.0 if the child is SEC5.0
    3. Update the parent to SEC5.2 if the child is SEC5.2 (recommended)
    4. Revert the child to SEC5.1 if the child is SEC5.2
    5. Configure the child SUM to update directly from Sophos
    6. Install SEC5.0 or SEC5.2 at the parent level (on a new machine) configured with the same package configuration as the SEC5.1 install. Use this new SEC5.0 or SEC5.2 warehouse as the updating location for the child SUM(s).

Note: Modifying the SEC install by running Setup.exe will recreate the SophosPA registry key, requiring step 1 to be actioned again.

When the parent is SEC5.0 and the child is SEC5.1 or SEC5.2

  1. If Patch is not required at the child level
    1. Access the child machine
    2. Before you start ensure that you have read the warnings about editing the registry.
    3. Backup the following registry key:
      • For 32-bit systems this will be HKLM\SOFTWARE\Sophos\EE\Products\SophosPA\
      • For 64-bit systems this will be HKLM\SOFTWARE\Wow6432Node\Sophos\EE\Products\SophosPA\
    4. Delete the above registry key
    5. Access the 'Update Managers' view in Sophos Enterprise Console, right-click the Update manager Computer name and choose 'Update Now'.

  2. If Patch is required at the child level (requires Internet access and not supported in an air-gap environment), choose one of the following options appropriate to your set-up
    1. Update the parent to SEC5.1 or SEC5.2 (recommended)
    2. Revert the child to SEC5.0
    3. Configure the child SUM to update directly from Sophos
    4. Install SEC5.1 or SEC5.2 at the parent level (on a new machine) configured with the same package configuration as the SEC5.0 install. Use this new SEC5.1 or SEC5.2 warehouse as the updating location for the child SUM(s).

Note: Modifying the SEC install by running Setup.exe will recreate the SophosPA registry key, requiring step 1 to be actioned again. 

When the parent is SEC4.x and the child is SEC5.0, SEC5.1 or SEC5.2

  1. If Patch is not required at the child level
    1. Access the child machine
    2. Before you start ensure that you have read the warnings about editing the registry.
    3. Backup the following registry key:
      • For 32-bit systems this will be HKLM\SOFTWARE\Sophos\EE\Products\SophosPA\
      • For 64-bit systems this will be HKLM\SOFTWARE\Wow6432Node\Sophos\EE\Products\SophosPA\
    4. Delete the above registry key
    5. Access the 'Update Managers' view in Sophos Enterprise Console, right-click the Update manager Computer name and choose 'Update Now'.

  2. If Patch is required at the child level (requires Internet access and not supported in an air-gap environment), choose one of the following options appropriate to your set-up
    1. Update the parent to SEC5.0, SEC5.1 or SEC5.2 (recommended)
    2. Revert the child to SEC4.x (same as parent)
    3. Configure the child SUM to update directly from Sophos
    4. Install SEC5.0, SEC5.1 or SEC5.2 at the parent level (on a new machine) configured with the same package configuration as the SEC4.x install. Use this new SEC5.0, SEC5.1 or SEC5.2 warehouse as the updating location for the child SUM(s).

Note: Modifying the SEC install by running Setup.exe will recreate the SophosPA registry key, requiring step 1 to be actioned again.





 
Per maggiori informazioni o per assistenza, vi preghiamo di contattare il supporto tecnico.

Valutate l'articolo

Molto scadente Eccellente

Commenti