jimwillsher 65 Posted March 4, 2015 Share Posted March 4, 2015 In ERA6 I get "Recent update attempts failed" showng against a couple of dozen clients. So I trigger an "update Virus DB" command, wait a few miutes, then look at the tasks against the computers (in ERA). All completed successfully. So I then wait a couple more minutes....then another 5 minutes....then another 5 minutes....and still the computers are all red. Even though recent updates were successful. My agents are connecting every 60 seconds. Does this sound right? it doesn;t sound right to me, as it's showing stale information in the webconsole. Jim Link to comment Share on other sites More sharing options...
jimwillsher 65 Posted March 4, 2015 Author Share Posted March 4, 2015 Ok, so restarting the agent on the cilient PCs seems to fix this. So my question: how often does the agent tell the server that "updates are fine" and do we have any control over that time interval? My agents currently phone home eveyr 60 seconds but clearly they don't pass this info every time they connect. Link to comment Share on other sites More sharing options...
ESET Staff michalp 20 Posted March 6, 2015 ESET Staff Share Posted March 6, 2015 Most probably "Recent update attempts failed" alert was initiated by Agent and not by EES. Next time, you can verify that by clicking on the alert, then you will be redirected to Alerts view and then by looking at Product column, you will be able to identify source of the alert. Agent updates modules that are used for configuration purposes of managed products. This update interval is controlled by policy ESET Remote Administrator Agent -> Updates -> Update Interval. Default interval is set to every 6 hours. If there was some problem with update, then the alert will be generated. The alert will be cleared, if next module update will succeed. Exact error code is in Agent trace log on a line that starts with "PerformUpdate: UpdPerformUpdate failed with error: ". From that number, I will be able to tell exactly what was the problem. Link to comment Share on other sites More sharing options...
Renato Alves Nogueira 1 Posted March 31, 2015 Share Posted March 31, 2015 Hello Michal, What means this error message: Error: CUpdatesModule [Thread 9e8]: PerformUpdate: UpdPerformUpdate failed with error: 4612 Link to comment Share on other sites More sharing options...
ESET Staff michalp 20 Posted April 1, 2015 ESET Staff Share Posted April 1, 2015 4612 is very generic error "Can't download". Probably update servers were not fully accessible. Usually next update will succeed. Reporting of agent's update errors will be changed in the future. Link to comment Share on other sites More sharing options...
Renato Alves Nogueira 1 Posted April 1, 2015 Share Posted April 1, 2015 this error is occurring a lot of days. I've already tried many things but nothing works. There is no either Proxy Server neither proxy http and the update servers are from Eset. after this error, the three next try failed also. 2015-03-31 22:02:27 Error: CUpdatesModule [Thread 16cc]: PerformUpdate: UpdPerformUpdate failed with error: 4612 2015-04-01 04:02:27 Error: CUpdatesModule [Thread 12e8]: PerformUpdate: UpdPerformUpdate failed with error: 4612 2015-04-01 10:02:27 Error: CUpdatesModule [Thread a38]: PerformUpdate: UpdPerformUpdate failed with error: 4612 Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted April 2, 2015 ESET Moderators Share Posted April 2, 2015 Hello Renato, can you please send me export of the endpoint's settings and network communication captured by Wireshark during unsuccessful update attempt? We will check it. P.R. Link to comment Share on other sites More sharing options...
Renato Alves Nogueira 1 Posted April 9, 2015 Share Posted April 9, 2015 Peter, i sent you a PM with the attached files. You should know. I unninstall and reinstall all of the system with default settings. After that the problem still occurring. I checked the wireshark data, get DNS, HTTP e TCP data but, i didnt see nothing wrong. Link to comment Share on other sites More sharing options...
sleatcoc 1 Posted April 16, 2015 Share Posted April 16, 2015 (edited) Could someone update this topic? I'm running into the same issue, but i'm not sure where to start looking to resolve it. Keep getting 120+ computers/servers screaming at me that recent updates failed - but when I check the end-clients, its all updated to the latest version of the db. Disregard above, I think I have it figured out... There's a few default policies for RA Agents. Just needed to include all computers/pcs to one of the default policy. Admin > Policies > RAA - Connection - Connect every 20/60 minutes > Edit > Targets > Include all computers (or whatever you want in the target) Edited April 16, 2015 by sleatcoc Link to comment Share on other sites More sharing options...
Renato Alves Nogueira 1 Posted April 16, 2015 Share Posted April 16, 2015 Using this template policies fixed your problem? Link to comment Share on other sites More sharing options...
sleatcoc 1 Posted April 16, 2015 Share Posted April 16, 2015 (edited) Using this template policies fixed your problem? Yes - or so it seems. After applying the policy, 122 computers with error went down to 69. I'm waiting a bit longer than checking to see why the rest are still displaying it. --update--- I guess I am not understanding the policies correctly. After doing the above adjustments, my errors went down but after an hour, it is building back up with the same error message again. Edited April 16, 2015 by sleatcoc Link to comment Share on other sites More sharing options...
Administrators Marcos 5,070 Posted April 16, 2015 Administrators Share Posted April 16, 2015 Could you please check details of the alerts to find out if they originated from agent or and Endpoint client? Link to comment Share on other sites More sharing options...
sleatcoc 1 Posted April 16, 2015 Share Posted April 16, 2015 (edited) Could you please check details of the alerts to find out if they originated from agent or and Endpoint client? I went through a good 20 of them and they are all agents. I did a modification to the policy to adjust from 20 minutes to 10 minutes and that's what prompted the amount of errors to go back up. I just readjusted the policy again back to default of 20 minutes, it's now at 40 errors left, but slowly building back up again. took some screenshots from snipping tool, but board does not allow posting of png files? Edited April 16, 2015 by sleatcoc Link to comment Share on other sites More sharing options...
Renato Alves Nogueira 1 Posted April 16, 2015 Share Posted April 16, 2015 Dude, are you understanding that this erros is not from the virus database update but from the agent? I fix thi problem this week. I just waiting one more day because i am talking with Peter and maybe he wants add some detail. If not, tomorrow i´ll publish how i did to fix it. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,070 Posted April 16, 2015 Administrators Share Posted April 16, 2015 There's a known issue with updating agent that is going to be addressed in the upcoming service build, hence I asked about the component/product generating the alerts. We have a dll with a fix to this issue so we can provide it to you for testing. Link to comment Share on other sites More sharing options...
ucvijan 4 Posted April 17, 2015 Share Posted April 17, 2015 Hi, Just to ask to confirm, as i have the same issue last couple of days.. Everything worked fine and with no problems, and since i think yesterday i get all my clients showing that recent update failed. They are all ESET Agent. I did restart agent, they come back as ok, but after some time they slowly all become red. Nothing changed in my environment the last couple of days, so dont know what happened. Is this the same issue as you are talking about Marcos? I even thought it was DB update, so i removed proxy all together,but guess its not that. Link to comment Share on other sites More sharing options...
sleatcoc 1 Posted April 17, 2015 Share Posted April 17, 2015 (edited) Finally got a call from Business Support Team. Working with Jeremy right now, the above things I tried seemed to had only fixed it temporarily, it went back up to 120+ errors again. I'm not getting why Jeremy's looking at the Antivirus DB Update / Apache HTTP Proxy, because the issue is mainly Remote Agents in the log. I'm hoping he finds something and gets it fixed. Renato Alves Nogueira, let us know if you get a fix. I'll confirm on my end if Jeremy's able to fix ours in a bit. ------Update------- It looks like there was an update released last week that broke something with the Remote Agents. We had to delete all records of the RAs in ERA (go into computers > all > sort by devices with Agents installed > filter by agents with errors > Select All, Delete them all.), then Jeremy modified our Active Directory Synchronization to be active so it matched up anything reporting in to it's proper group. My errors are finally going down, albeit a bit slow, but that's dependent on the RAs interval of reporting in. I'll update if this is still an issue in the next 24 hours, if it's fixed - consider this my last post for this issue. Edited April 18, 2015 by sleatcoc Link to comment Share on other sites More sharing options...
Administrators Marcos 5,070 Posted April 18, 2015 Administrators Share Posted April 18, 2015 There's a known issue with agent updates that is discussed in another topic. It will be addresses in the upcoming service build of ERA v6 soon. Link to comment Share on other sites More sharing options...
LocknetSSmith 6 Posted August 10, 2015 Share Posted August 10, 2015 Our endpoints are getting the error (v6.x ERAS in our DMZ) 2015-08-10 09:18:57 Error: CUpdatesModule [Thread c3c]: PerformUpdate: UpdPerformUpdate failed with error: 84492015-08-10 15:18:57 Error: CUpdatesModule [Thread 14d0]: PerformUpdate: UpdPerformUpdate failed with error: 8449 Is this something you (Marcos) can point me in the right direction on fixing? Link to comment Share on other sites More sharing options...
Recommended Posts