Small update (340kB) takes hours and never completes

[Bordonbert 0]

Hi.  I have found references to this problem but they don't seem to have any solution to my own version.  I have had no problems at all with internet connectivity until today.  Eset IS 13.2.15.0 identified an update and I started it.  It reported the total update would be about 340MB.  The machine ground to a halt in terms of all internet activity.  The update crawled along, and I mean crawled, at a few kB at a time with no HDD activity to speak of until after about 30mins at about 40% completed it failed.  I tried again and the same thing happened, then again.  However I did notice that each time I restarted it reported a smaller download and apparently started with a sizeable chunk already in place.  These figures did not match up between each attempt.

I have even tried the update with the Firewall switched off but no difference.  It has now given up on the update reporting "File not found on server" if I search for any available updates.  Is there something currently going on at Eset central which is causing this problem or is it in my own system?

Edited July 9, 2020 by Bordonbert

[Marcos 5,074]

Updates are small, typically a few kB in size. Even application updates are small; for v13.2 they varied from 1 MB to 30 MB, depending on the version from which you updated. 340 MB can be achieved only by enabling the mirroring feature which is not available in consumer products.

Are you able to reproduce the issue? What product and version did you have installed before upgrade?

[Bordonbert 0]

I'm sorry Marcos, I've misled you by typing faster than I can think.  The update was originally only somewhere around 340kB not MB!  My apologies for misleading you like that.  That's why it was such a surprise to take so long in picking up a few kB at a time every couple of minutes.

I've just done another restart and tried it again with the same result.  I get a yellow "Attention required" warning with "Modules update failed" under it then when I click on "Update modules" it tries but comes back with "File not found on server".  I've just booted up an older Win7 machine I have with Eset IS on that too and it has done exactly the same thing but with totally different filesize reporting.

Help And Support reports my current version is 13.2.15.0 licenced until 08/2022.

[Marcos 5,074]

Please carry on as follows:
- enable advanced logging under Help and support -> Details for technical support
- run update
- stop logging
- collect logs with ESET Log Collector and upload the generated archive here.

[Bordonbert 0]

I'm still trying to get my hands on the Log Collector app at the moment.  Of course it is a download and it took over 5mins to show as 0.1MB of 4.8MB.  It trickled along for a long while so I persevered.  Then it also failed!  Judging by the activity on my router which was going crazy, there is something somewhere which is choking the life out of my connection.  I now have every other device on the network switched off but my own PC and the traffic has calmed down a bit but is still pretty active.

My current situation is that the download of Log Collector app has failed at just over 1MB.  Eset IS started the update once again of its own volition.  I have also cleared the update cache and tried again manually but with no difference.  I am running Wireshark on the network and can see a stream of packets from and to updf5.wip.eset.com.  Many of these are reporting [TCP Retransmission] followed by [TCP previous segment not captured].  There is a long stream of those blocks where you can see the multiple attempts listed one after the other.  Once the upgrade fails you can also see this with communications with other sites too.

I'm totally flummoxed.

[Bordonbert 0]

Pinging the eset server by name I mentioned above, updf5.wip.eset.com gets a mixture of 31/32ms responses and response timed out so the connection to it looks shaky at best.  Settinbg up a display filter for "ip.addr == wupdf5.wip.eset.com" crashes Wireshark consistently and that is something I have never known.

[Bordonbert 0]

Well!!!  I pushed the app download by repeatedly waiting for it to fail and then resuming it so it gradually picked its way across the entire download.  It finished by locking up and reporting that it only had 2.8MB then after a couple of minutes it suddenly decided it had the whole 4.8MB file.  What do I know?

The app has collected its logfiles but I'm not sure they will contain anything useful yet as I am not sure what order to do all of this in.  It will not upload to the site as the .zip is 250MB.  I obviously left logging on too long even though it was only for the duration of the painfully long download process.

In the meantime the update has actually completed successfully, don't ask me how.  I therefore cannot run it again to collect a new set of logfiles until the problem shows up again.  On downloading the LogCollector app it takes literally no perceptible time at all to download the whole 4.8MB again.  I'll have to rest this here for the moment but if it is ok I will leave the thread open until I have updated again and can be sure things are clear.

Apologies for the fragmented nature of this issue but it has been like knitting fog here at my desk.

Edited July 9, 2020 by Bordonbert

[Marcos 5,074]

You could create a pcap log with Wireshark and filters for ports 80 and 53 to reduce the amount of logged data. Also close any network-aware applications that generate traffic during update.