Jump to content

Red line: Recent update attempts failed


jimwillsher
 Share

Recommended Posts

In ERA6 I get "Recent update attempts failed" showng against a couple of dozen clients. So I trigger an "update Virus DB" command, wait a few miutes, then look at the tasks against the computers (in ERA). All completed successfully. So I then wait a couple more minutes....then another 5 minutes....then another 5 minutes....and still the computers are all red. Even though recent updates were successful.

 

My agents are connecting every 60 seconds.

 

Does this sound right? it doesn;t sound right to me, as it's showing stale information in the webconsole.

 

 

 

Jim

Link to comment
Share on other sites

Ok, so restarting the agent on the cilient PCs seems to fix this. So my question: how often does the agent tell the server that "updates are fine" and do we have any control over that time interval? My agents currently phone home eveyr 60 seconds but clearly they don't pass this info every time they connect.

Link to comment
Share on other sites

  • ESET Staff

Most probably "Recent update attempts failed" alert was initiated by Agent and not by EES. Next time, you can verify that by clicking on the alert, then you will be redirected to Alerts view and then by looking at Product column, you will be able to identify source of the alert.

 

Agent updates modules that are used for configuration purposes of managed products. This update interval is controlled by policy ESET Remote Administrator Agent -> Updates -> Update Interval. Default interval is set to every 6 hours. If there was some problem with update, then the alert will be generated. The alert will be cleared, if next module update will succeed.

 

Exact error code is in Agent trace log on a line that starts with "PerformUpdate: UpdPerformUpdate failed with error: ". From that number, I will be able to tell exactly what was the problem.

Link to comment
Share on other sites

  • 4 weeks later...
  • ESET Staff

4612 is very generic error "Can't download". Probably update servers were not fully accessible. Usually next update will succeed. Reporting of agent's update errors will be changed in the future.

Link to comment
Share on other sites

this error is occurring a lot of days. I've already tried many things but nothing works. There is no either Proxy Server neither proxy http and the update servers are from Eset. after this error,  the three next try failed also.

 

2015-03-31 22:02:27 Error: CUpdatesModule [Thread 16cc]: PerformUpdate: UpdPerformUpdate failed with error: 4612

2015-04-01 04:02:27 Error: CUpdatesModule [Thread 12e8]: PerformUpdate: UpdPerformUpdate failed with error: 4612

2015-04-01 10:02:27 Error: CUpdatesModule [Thread a38]: PerformUpdate: UpdPerformUpdate failed with error: 4612

Link to comment
Share on other sites

  • ESET Moderators

Hello Renato,

 

can you please send me export of the endpoint's settings and network communication captured by Wireshark during unsuccessful update attempt?

 

We will check it.

 

P.R.

Link to comment
Share on other sites

Peter, i sent you a PM with the attached files. You should know. I unninstall and reinstall all of the system with default settings. After that the problem still occurring. I checked the wireshark data, get DNS, HTTP e TCP data but, i didnt see nothing wrong.

Link to comment
Share on other sites

Could someone update this topic? I'm running into the same issue, but i'm not sure where to start looking to resolve it.  Keep getting 120+ computers/servers screaming at me that recent updates failed - but when I check the end-clients, its all updated to the latest version of the db.

 

Disregard above, I think I have it figured out...

 

There's a few default policies for RA Agents.  Just needed to include all computers/pcs to one of the default policy.

 

Admin > Policies > RAA - Connection - Connect every 20/60 minutes > Edit > Targets > Include all computers (or whatever you want in the target)

Edited by sleatcoc
Link to comment
Share on other sites

Using this template policies fixed your problem?

Yes - or so it seems.  After applying the policy, 122 computers with error went down to 69.  I'm waiting a bit longer than checking to see why the rest are still displaying it.

 

--update---

I guess I am not understanding the policies correctly.  After doing the above adjustments, my errors went down but after an hour, it is building back up with the same error message again.

Edited by sleatcoc
Link to comment
Share on other sites

  • Administrators

Could you please check details of the alerts to find out if they originated from agent or and Endpoint client?

Link to comment
Share on other sites

Could you please check details of the alerts to find out if they originated from agent or and Endpoint client?

 

I went through a good 20 of them and they are all agents.  I did a modification to the policy to adjust from 20 minutes to 10 minutes and that's what prompted the amount of errors to go back up.  I just readjusted the policy again back to default of 20 minutes, it's now at 40 errors left, but slowly building back up again.

 

took some screenshots from snipping tool, but board does not allow posting of png files?

Edited by sleatcoc
Link to comment
Share on other sites

Dude, are you understanding that this erros is not from the virus database update but from the agent? I fix thi problem this week. I just waiting one more day because i am talking with Peter and maybe he wants add some detail. If not, tomorrow i´ll publish how i did to fix it.

Link to comment
Share on other sites

  • Administrators

There's a known issue with updating agent that is going to be addressed in the upcoming service build, hence I asked about the component/product generating the alerts. We have a dll with a fix to this issue so we can provide it to you for testing.

Link to comment
Share on other sites

Hi,

 

Just to ask to confirm, as i have the same issue last couple of days.. Everything worked fine and with no problems, and since i think yesterday i get all my clients showing that recent update failed. They are all ESET Agent. I did restart agent, they come back as ok, but after some time they slowly all become red. 

 

Nothing changed in my environment the last couple of days, so dont know what happened. Is this the same issue as you are talking about Marcos? 

I even thought it was DB update, so i removed proxy all together,but guess its not that. 

Link to comment
Share on other sites

Finally got a call from Business Support Team.  Working with Jeremy right now, the above things I tried seemed to had only fixed it temporarily, it went back up to 120+ errors again.

 

I'm not getting why Jeremy's looking at the Antivirus DB Update / Apache HTTP Proxy, because the issue is mainly Remote Agents in the log.  I'm hoping he finds something and gets it fixed.

 

Renato Alves Nogueira, let us know if you get a fix.  I'll confirm on my end if Jeremy's able to fix ours in a bit.

 

------Update-------

It looks like there was an update released last week that broke something with the Remote Agents.  We had to delete all records of the RAs in ERA (go into computers > all > sort by devices with Agents installed > filter by agents with errors > Select All, Delete them all.), then Jeremy modified our Active Directory Synchronization to be active so it matched up anything reporting in to it's proper group.  My errors are finally going down, albeit a bit slow, but that's dependent on the RAs interval of reporting in.

 

I'll update if this is still an issue in the next 24 hours, if it's fixed - consider this my last post for this issue.

Edited by sleatcoc
Link to comment
Share on other sites

  • Administrators

There's a known issue with agent updates that is discussed in another topic. It will be addresses in the upcoming service build of ERA v6 soon.

Link to comment
Share on other sites

  • 3 months later...

Our endpoints are getting the error (v6.x ERAS in our DMZ) 

 

2015-08-10 09:18:57 Error: CUpdatesModule [Thread c3c]: PerformUpdate: UpdPerformUpdate failed with error: 8449
2015-08-10 15:18:57 Error: CUpdatesModule [Thread 14d0]: PerformUpdate: UpdPerformUpdate failed with error: 8449

 

Is this something you (Marcos) can point me in the right direction on fixing?

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...