Some clients not updating anymore

[jeroen_es 1]

We have a local server in our network running version 5.1.34 of the ESET server. This server downloads the virus updates and all clients, running version 5.0.2225.0 of ESET Endpoint Antivirus, in our network download their updates from that server. That all worked just fine until recently: now some clients fail to download the update from the server, while it is still working for some other clients. There is no real difference between the clients (all are running the same version of Windows 8.1 with all latest updates). In fact: on one of the clients everything was still working properly this morning, then we uninstalled ESET and reinstalled it on that client and now that client doesn't download updates from the server anymore..

I have set the logfile on the client to verbose and here's what is says (this is part of the log .xml file):

 

Status: status=2; title=Error downloading the update; text=%ProductName% has not been able to connect to the update server recently to check for the latest virus signature updates. Please check your network connectivity and then try to update the virus signature database again

<COLUMN NAME="Module">Update module</COLUMN>

<COLUMN NAME="Event">Updater: retval = 0x1105, failures: 9</COLUMN>

<COLUMN NAME="User">NT AUTHORITY\SYSTEM</COLUMN>

.

Any ideas??

 

Thanks,

Jeroen

[Marcos 5,071]

We'd need to get and review an etw log from updater. Carry on as follows:

- download this archive and extract it

- run RegisterEsetEtw.reg to enable logging

- restart the computer

- reproduce the error

- run UnregisterEsetEtw.reg

- restart the computer

- compress the log EsetEventLog.etl located in C:\Windows\System32\LogFiles\WMI and send it to me attached to a personal message.

[jeroen_es 1]

Thank you for your reply Marcos. However, for some reason the issue seems to have disappeared today: all clients that weren't updating for about a week or so have properly updated their definitions this morning. I have no idea why it didn't work before because as far as I'm aware nothing changed between yesterday and today but I guess that for now the issue can be considered resolved. Should this still change in the future then I'll follow the instructions you gave and send you the logfile you requested.

 

Thanks,

Jeroen