Signature and Module Updates

[offbyone 10]

Hi.

I still have some problems in understanding which settings control how often a client checks for signature and module updates.

I found that these check are done when a client computer is started.

I found that the the agent policy settings "Updates/Update interval" and "Connection/Connection interval" do not seem to influence it.

On the Endpoint Client Policy I only found "Enable more frequent updates of detection signature" but more frequent to what?

Seems that I am really overlooking something obvious. Maybe you can give me a hint.

THX a lot.

[Marcos 5,070]

Automatic updates are ensured via the regular automatic update task in scheduler. You can control how often the task will run. By default it's 60 min. but it's also possible to shorten it to 10 min. if I remember correctly. The "more frequent updates" settings refers to streamed updates that are downloaded every few minutes.

[offbyone 10]

Hi Marcos,

thanks for you fast response.

Ok now I found that 60 minutes on the client itself. So if I understood you correctly a scheduled clients task has to be setup via ESMC as this is not influenced by any policy settings.

Regards

[offbyone 10]

Ok now I found the settings on ESMC side.

It's within Endpoint Client Policy at "Settings/TOOLS/SCHEDULER/Edit/Automatic update ....."

Edited June 27, 2020 by offbyone

[offbyone 10]

I still don't get it working.

Update checking works when the computer is started.

Update checking works if you click on "Check for Updates" in the client GUI.

However when the computer is just running no update checking is done on its own. I let the computer switched on during the night however the client GUI still displays that the last update check was done when it was started yesterday.

Scheduler settings are on its default values (60 minutes). Any suggestions how to track down the problem?

THX again.

[Marcos 5,070]

If installing Endpoint 7.3 from scratch with default settings doesn't make any difference, please open a ticket with your local ESET support for further investigation.

[offbyone 10]

For sake of better testing I just changed the interval of the scheduler via policy from defaults to 10 minutes an now it's working. Before scheduler haven't been touched in the policy at all. From the client GUI I saw that it was set to 60 minutes before. Also executing the task manually from the client scheduler worked before without a problem.

Time for rolling back snapshots to duplicate the problem. Don't want to rollout the solution to hundreds of devices an then being faced by such a problem in the wild.

[offbyone 10]

There is obviously something wrong.

I reset the snapshot of the client to a plain vanilla Windows 10 installation and deployed ESET AV. Autoupdate worked as it should afterwards. Then I rebooted the machine and observed update. This still worked. But after another reboot autoupdate check stopped working and never come to work again as with the previous install even after several reboots.

This seems to be very unreliable. Seems I have to open a support case. Project will be stopped so far.

Cheers.

[offbyone 10]

I found the following bug report. Sound like it is a similar problem:

Link

Seems that I have a huge problem now.

[Marcos 5,070]

Do you have Endpoint v7.3 installed? Next week we're going to release a hotfix v7.3 which will also have some issues with Scheduler fixed so it might be worth to try it then.

[offbyone 10]

We are running 7.3.2032.

Yes the hotfix would be worth a try. Currently we are still in the evaluation phase for replacing an existing AV solution for all our customers. Without this problem being solved it would be impossible to deploy it to our customers.

Cheers.

[Peter Randziak 1,130]

Hello guys,

in the Scheduler you can set update interval to 10 minutes, but the Updater checks the last attempt and in case the last update attempt was executed less than 10 minutes, it won't run again so practically 11 minutes is the shortest interval, which will work..

Peter

[offbyone 10]

Just opened a ticket with ESET support.

From what they said the hotfix should be released tomorrow.

 

[Chaluha 2]

Hi fixed version is 7.3.2036.0, should be released today.

 

Version 7.3.2036.0

• Fixed: System shutdown after a scheduled on-demand scan if no action was selected.
• Fixed: Sensitivity levels of detection mechanism would block files even if configured to report only.
• Fixed: Firewall rules editor could crash under some circumstances, particularly after many re-ordering changes.
• Fixed: The management console of ESET Enterprise Inspector is unable to obtain a copy of quarantined endpoint object.
• Fixed: Bootstrapped installer would abort if installation folder is not empty, regardless of forced background clean-up.
• Fixed: Certain sections in advanced settings would not render as a result of processing large configuration lists in the background.
• Fixed: Uninstallation process is blocked when advanced diagnostic logging of Network protection layer is enabled.
• Fixed: During product upgrade from version 6.x, Program Component Update (PCU) settings are not properly configured (to defaults) in managed networks.
• Fixed: Blocking of certain vendors' USB printers in Device control does not work.

Edited June 30, 2020 by Chaluha

[offbyone 10]

Just installed the new version and the problem still persists.

I'm really getting disappointed about that software. Don't get me wrong but an endpoint protection software which omit to update its signatures is a security problem.

[Chaluha 2]

13 hours ago, offbyone said:

Just installed the new version and the problem still persists.

I'm really getting disappointed about that software. Don't get me wrong but an endpoint protection software which omit to update its signatures is a security problem.

Yes I can canfirm that new version did not fixed this problem.  Version 7.2 was working fine. Need to be fixed ASAP.

[Roger Nock 1]

Yes, I can also confirm that a machine I updated 12 hrs ago to 7.3.2036 has not had its Detection Engine updated (the last update was to 21580 (20200630). 

Looking on https://www.virusradar.com/en/update/info/ I see the engine is at 21582

 

[offbyone 10]

Can you please try the following:

Modify the scheduler settings in the following way. Within policy management you will find it at:

Settings/TOOLS/SCHEDULER/Scheduler/Edit/Regular automatic update/Edit.

On the 4th dialog named "Skipped task" set it from "At the next scheduled time" to "As soon as possible".

Here this seems to fix the problem. However we have to further observe this as reaplplying scheduler settings with any settings fixed the problem in the past but only for a short time. Here it works since yesterday evening.

Cheers.

[Roger Nock 1]

@offbyone

I have updated my policy as the above and this has pushed an update of the Detection Engine.

I will see if this continues during the day and also if the older 7.3 clients get updates too.

Thanks for the help.

[offbyone 10]

@Roger Nock

That's great.

Please post back you findings, as ESET support is now also aware of this forum thread.

Edited July 1, 2020 by offbyone

[Chaluha 2]

It is working with this setting so far. We will see how long:-)

[Roger Nock 1]

All looks good, both 7.3.2032 and 7.3.2036 Detection Engines are updating 👍

I will now push the new client update on my users.

Cheers @offbyone

[offbyone 10]

@Roger Nock

Updating still works here also.

[tbsky 11]

@Marcos

    will endpoint release new version soon to fix the bug? and I didn't see current bugs list in https://support.eset.com/en/kb6927-known-issues-for-version-7-eset-business-products#ESMC

   I have bugs in mind like ESMC  Japanese product repositories, MySQL database minor version incompatibility, Endpoint upgrade settings incompatibility, schedule update.. etc.

  hope ESET can update the current issues base on current time line. it is wasting time to check the forum message one by one...

 

[Chaluha 2]

Hi I have an information from CZ support that new version that fixes this bug will be released next week.

https://translate.googleusercontent.com/translate_c?depth=1&pto=aue&rurl=translate.google.com&sl=cs&sp=nmt4&tl=en&u=https://servis.eset.cz/News/NewsItem/View/643&usg=ALkJrhgsXb8-wkYLDH_PuhYJfqsUuA7A8Q