Administrators Marcos 5,050 Posted May 7, 2016 Administrators Share Posted May 7, 2016 I have an open support case, and an ESET technician collected all the relevant logs from a problem machine yesterday.Please drop me a pm with your ticket number so that I can ask my colleagues from the US to pass me all logs and files they have collected. Link to comment Share on other sites More sharing options...
EricTallan 1 Posted May 9, 2016 Author Share Posted May 9, 2016 Done. Link to comment Share on other sites More sharing options...
slarkins 5 Posted May 9, 2016 Share Posted May 9, 2016 (edited) Hopefully some log file will allow Eset to determine a fix for this....the only common factor i see for pc's on my network that have the same issue......they have gone at least 10 days since a restart...and the only fix for updates to work is to restart the computer....I have a stand alone pc with same problem...not configured with an ERA server and gets its updates directly from ESET.. Edited May 9, 2016 by slarkins Link to comment Share on other sites More sharing options...
bbahes 29 Posted May 12, 2016 Share Posted May 12, 2016 Hopefully some log file will allow Eset to determine a fix for this....the only common factor i see for pc's on my network that have the same issue......they have gone at least 10 days since a restart...and the only fix for updates to work is to restart the computer....I have a stand alone pc with same problem...not configured with an ERA server and gets its updates directly from ESET.. Same problem here...two EES v5 clients three days with "Error downloading the update". I will try restarting one of them and report result. Link to comment Share on other sites More sharing options...
bbahes 29 Posted May 12, 2016 Share Posted May 12, 2016 Hopefully some log file will allow Eset to determine a fix for this....the only common factor i see for pc's on my network that have the same issue......they have gone at least 10 days since a restart...and the only fix for updates to work is to restart the computer....I have a stand alone pc with same problem...not configured with an ERA server and gets its updates directly from ESET.. Same problem here...two EES v5 clients three days with "Error downloading the update". I will try restarting one of them and report result. After reboot I did manual update on client and it updated successfully. Here is log from client: 12.5.2016. 14:40:05 ESET Kernel Virus signature database successfully updated to version 13477 (20160512). 10.5.2016. 8:19:49 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 10.5.2016. 6:19:39 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 10.5.2016. 4:19:36 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 10.5.2016. 2:19:38 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 10.5.2016. 0:19:34 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 9.5.2016. 22:19:22 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 9.5.2016. 20:19:21 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 9.5.2016. 18:19:21 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 9.5.2016. 16:19:17 Update module General compiler error. NT AUTHORITY\SYSTEM 9.5.2016. 14:19:16 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 9.5.2016. 12:19:14 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 9.5.2016. 10:19:13 Update module General compiler error. NT AUTHORITY\SYSTEM 9.5.2016. 8:19:11 Update module General compiler error. NT AUTHORITY\SYSTEM 9.5.2016. 6:19:09 Update module General compiler error. NT AUTHORITY\SYSTEM 9.5.2016. 4:19:09 Update module General compiler error. NT AUTHORITY\SYSTEM 9.5.2016. 2:19:06 Update module General compiler error. NT AUTHORITY\SYSTEM 9.5.2016. 0:19:05 Update module General compiler error. NT AUTHORITY\SYSTEM 8.5.2016. 23:19:09 Update module Invalid Username and/or Password. NT AUTHORITY\SYSTEM 8.5.2016. 15:19:10 ESET Kernel Virus signature database successfully updated to version 13456 (20160508). 8.5.2016. 11:19:06 ESET Kernel Virus signature database successfully updated to version 13455 (20160508). 7.5.2016. 21:18:55 ESET Kernel Virus signature database successfully updated to version 13454 (20160507). 7.5.2016. 15:18:50 ESET Kernel Virus signature database successfully updated to version 13453 (20160507). 7.5.2016. 11:18:46 ESET Kernel Virus signature database successfully updated to version 13452 (20160507). 7.5.2016. 1:18:38 ESET Kernel Virus signature database successfully updated to version 13451 (20160506). Link to comment Share on other sites More sharing options...
bbahes 29 Posted May 13, 2016 Share Posted May 13, 2016 Hopefully some log file will allow Eset to determine a fix for this....the only common factor i see for pc's on my network that have the same issue......they have gone at least 10 days since a restart...and the only fix for updates to work is to restart the computer....I have a stand alone pc with same problem...not configured with an ERA server and gets its updates directly from ESET.. Same problem here...two EES v5 clients three days with "Error downloading the update". I will try restarting one of them and report result. On second client different errors but same problem. After reboot client updated. Event 96747 12 hours ago 12 hours ago Normal ESET Kernel Virus signature database successfully updated to version 13479 (20160512). Event 96746 12 hours ago 5 days ago Critical Warning Update module Error allocating memory. NT AUTHORITY\SYSTEM Event 96745 12 hours ago 5 days ago Critical Warning Update module Error downloading file from update server NT AUTHORITY\SYSTEM Event 96744 12 hours ago 5 days ago Critical Warning Update module Error downloading file from update server NT AUTHORITY\SYSTEM Event 96743 12 hours ago 5 days ago Critical Warning Update module Error downloading file from update server NT AUTHORITY\SYSTEM Event 96742 12 hours ago 5 days ago Critical Warning Update module Error downloading file from update server NT AUTHORITY\SYSTEM Event 96741 12 hours ago 6 days ago Critical Warning Update module Error downloading file from update server NT AUTHORITY\SYSTEM Event 96740 12 hours ago 6 days ago Critical Warning Update module Error downloading file from update server NT AUTHORITY\SYSTEM Event 96739 12 hours ago 6 days ago Critical Warning Update module Error downloading file from update server NT AUTHORITY\SYSTEM Event 96738 12 hours ago 6 days ago Critical Warning Update module Error downloading file from update server NT AUTHORITY\SYSTEM Event 96737 12 hours ago 6 days ago Critical Warning Update module Error downloading file from update server NT AUTHORITY\SYSTEM Event 96736 12 hours ago 6 days ago Critical Warning Update module Error downloading file from update server NT AUTHORITY\SYSTEM Event 95679 6 days ago 6 days ago Critical Warning Update module Error downloading file from update server NT AUTHORITY\SYSTEM Event 95670 6 days ago 6 days ago Critical Warning Update module Invalid Username and/or Password. NT AUTHORITY\SYSTEM Event 95602 6 days ago 6 days ago Normal ESET Kernel Virus signature database successfully updated to version 13447 (20160506). Event 90508 1 month ago future Normal ESET Kernel Virus signature database successfully updated to version 13301 (20160407). Link to comment Share on other sites More sharing options...
slarkins 5 Posted May 16, 2016 Share Posted May 16, 2016 Any updates on a fix? The reboot option didnt work for a couple of pc's that were off for a few days and missed many signature updates.....the only way i got them to update was to switch their update server to my other ERA server ... Link to comment Share on other sites More sharing options...
slarkins 5 Posted May 19, 2016 Share Posted May 19, 2016 Any updates ESET? Link to comment Share on other sites More sharing options...
LT.Son 0 Posted May 19, 2016 Share Posted May 19, 2016 As the issue persists, please continue as follows: 1, download and install Wireshark as well as Process Monitor. 2, run the following command from the command line prompt started with administrator rights logman start updater -p {f329ae9a-556d-4934-920f-234e835d9ece} 0xffffff 10 -o C:\eset.etl -ets 3, start logging with Wireshark and Process Monitor 4, run update (wait until an error occurs) 5, stop logging in Wireshark and Process Monitor and save the logs 6, run the command "logman stop updater -ets" with administrator rights 7, collect logs using ESET Log Collector (ELC) from both the workstation and server where a mirror is created 8, create a listing of the mirror folder (e.g. dir c:\mirror > mirror.txt) on the server 9, compress all 3 logs + the listing of the mirror folder, upload them to a safe location along with ELC logs and pm me the download links. I have the same issue on several servers, and I've collected the logs... How do I PM you? I do not see a User Name, only the moderators group. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,050 Posted May 20, 2016 Administrators Share Posted May 20, 2016 I've been helping guys from ESET LLC troubleshoot these update issues. So far it seems that in all cases users had an older version of Endpoint installed which contained updater that didn't work well under specific circumstances when a x64 module was released. The issue was fixed in 5.0.2254. Let us know if upgrading to the latest version solves the issue for you. Note: The latest version 5.0.2260 uses a new signature. As a result, clients cannot be upgraded using the Upgrade client task and only push installation works. Should that be a problem for you, let me know. At least you could try installing it manually or using a push install task on at least one pc just to see if the issue actually goes away. Link to comment Share on other sites More sharing options...
slarkins 5 Posted May 20, 2016 Share Posted May 20, 2016 (edited) I have the issue in both 5.0.2254(only about 5-6 pc's so far) AND one client i upgraded to 5.0.2260. in order to try to solve the error...after upgrading that one client to 2260(the one that seems to trip the error the most)...2 days later...same error downloading update... ....actually the first pc on my network that got this error a month ago....was a x32 WinXP pc.... I see no pattern to the problem...Win 7 x64, WinXP x32....i have pc's with update errors pointing to 2 different ERA servers...i even have a standalone pc not linked to a ERA server and downloading updates directly from ESET that got the update error once a couple of weeks ago...i upgraded that client to 2260 and havent seen the error since...it used to be pc's that didnt get rebooted for over a week but the client i upgraded to 2260 only went 2 days before it had an issue...2 observations on stuck clients...in ERA...the configuration tab for last configuration download...is hours before...usaully when the last successful signature installed....and also watching the actual update process on the client...it completes the download...then the second page...it gets as far as 1 / 2 then errors out befroe the 2 /2 completes... Edited May 20, 2016 by slarkins Link to comment Share on other sites More sharing options...
gymmbo 0 Posted May 23, 2016 Share Posted May 23, 2016 I am experiencing the same thing but with about 40 clients out of 1200. I changed my update server to Choose Automatically and it appears to be updating but it then fails. Link to comment Share on other sites More sharing options...
bbahes 29 Posted May 23, 2016 Share Posted May 23, 2016 (edited) I've been helping guys from ESET LLC troubleshoot these update issues. So far it seems that in all cases users had an older version of Endpoint installed which contained updater that didn't work well under specific circumstances when a x64 module was released. The issue was fixed in 5.0.2254. Let us know if upgrading to the latest version solves the issue for you. Note: The latest version 5.0.2260 uses a new signature. As a result, clients cannot be upgraded using the Upgrade client task and only push installation works. Should that be a problem for you, let me know. At least you could try installing it manually or using a push install task on at least one pc just to see if the issue actually goes away. On my network only clients that we upgraded from EEA 5.0.2260 to EES 5.0.2260 are affected with this problem. EEA 5.0.2254 & 5.0.2260 don't have this problem. Same errors on EES client today: 23.5.2016. 14:59:37 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 23.5.2016. 12:59:35 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 23.5.2016. 10:59:35 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 23.5.2016. 8:59:34 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 23.5.2016. 6:59:29 Update module Could not connect to server. NT AUTHORITY\SYSTEM 21.5.2016. 12:49:26 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 21.5.2016. 10:49:26 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 21.5.2016. 8:49:24 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 21.5.2016. 6:49:33 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 20.5.2016. 13:58:49 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 20.5.2016. 11:58:48 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 20.5.2016. 9:58:48 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 20.5.2016. 7:58:46 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 20.5.2016. 5:58:57 Update module Error downloading file from update server NT AUTHORITY\SYSTEM 19.5.2016. 13:56:40 Update module General compiler error. NT AUTHORITY\SYSTEM 19.5.2016. 12:56:44 Update module Invalid Username and/or Password. NT AUTHORITY\SYSTEM Edited May 23, 2016 by bbahes Link to comment Share on other sites More sharing options...
Gamtat 1 Posted May 24, 2016 Share Posted May 24, 2016 ERA 5.1.34.0 6 out of 70 clients reporting error. All Windows 7 Pro x64 running 5.0.2126. They're stuck on update 13513. I will attempt to upgrade to 2260 - hopefully that will solve the problem. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,050 Posted May 24, 2016 Administrators Share Posted May 24, 2016 ERA 5.1.34.0 6 out of 70 clients reporting error. All Windows 7 Pro x64 running 5.0.2126. They're stuck on update 13513. I will attempt to upgrade to 2260 - hopefully that will solve the problem. Also try restarting the computer. I've run into a case today when the user had their computer running for 10 days and was getting the above mentioned error due to issues with memory allocation. Not sure what caused it, whether a specific Windows update or something else as it's subject for further investigation, however, restarting the computer solved the problem. Link to comment Share on other sites More sharing options...
Gamtat 1 Posted May 24, 2016 Share Posted May 24, 2016 Rebooting problem clients didn't change anything but upgrading to 5.0.2260 seems to have fixed the problem for now. Link to comment Share on other sites More sharing options...
rockshox 5 Posted May 24, 2016 Share Posted May 24, 2016 It appears ESET released an alert on this issue. The fix is to install 5.0.2254 however I believe it is well documented in this thread that clients with 5.0.2254 have been experiencing this same issue. I know for sure that I had at least a dozen 5.0.2254 clients that have had this issue. hxxp://support.eset.com/alert6056/ Link to comment Share on other sites More sharing options...
Administrators Marcos 5,050 Posted May 24, 2016 Administrators Share Posted May 24, 2016 Endpoint 5.0.2254 has a bug with updating x64 modules fixed. However, I've run into cases when the problem was with memory allocation on systems that have been running for several days without a restart. Restarting the system helps in this case. Also we continue with the investigation as to whether the memory allocation issues started to happen after recent Windows updates or if there's something else that is causing them. Link to comment Share on other sites More sharing options...
slarkins 5 Posted May 25, 2016 Share Posted May 25, 2016 (edited) All my problems started with 2254(this is the version i upgraded all my 4.x clients to when i upgraded to 5.x)...it hasnt been resolved in this version....i actually upgraded on of my bad clients to 2260....error tripped after running for 2 days...this is not WIndows update related as this pc has had windows updates turned off since January and started the error in April....the only pc's with 2260 are the ones i upgraded to try to fix the error downloading update.... ...i still say something changed in the definition update packaging back in April...my standalone pc had 2254 installed for almost a year...runs 24/7...only reboot is monthly for windows updates...never had an issue....until 3 weeks ago...shut down pc to move it....8 or so days later...i got a warning about av being out of date...to my surprise....same error downloading update ...stuck for 2 days,....reboot to continue downloads... Edited May 25, 2016 by slarkins Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,128 Posted May 25, 2016 ESET Moderators Share Posted May 25, 2016 Hello Slarkins, As the issue persists, please continue as follows: 1, download and install Wireshark as well as Process Monitor. 2, run the following command from the command line prompt started with administrator rights logman start updater -p {f329ae9a-556d-4934-920f-234e835d9ece} 0xffffff 10 -o C:\eset.etl -ets 3, start logging with Wireshark and Process Monitor 4, run update (wait until an error occurs) 5, stop logging in Wireshark and Process Monitor and save the logs 6, run the command "logman stop updater -ets" with administrator rights 7, run procdump from elevated command line with -ma switch for ekrn i.e. procdump -ma ekrn 8, collect logs using ESET Log Collector (ELC) from both the workstation and server where a mirror is created 9, create a listing of the mirror folder (e.g. dir c:\mirror > mirror.txt) on the server 10, compress all logs + the listing of the mirror folder, upload them to a safe location along with ELC logs and pm me the download link. I will check it with Devs with priority. Thanks, P.R. Link to comment Share on other sites More sharing options...
slarkins 5 Posted May 25, 2016 Share Posted May 25, 2016 (edited) i received same instructions via support request email...i actually think your steps above were updated and changed to something a little different as i received a followup email from support with different instructions.. -Download the tracelog.exe utility from hxxp://ftp.nod.sk/~petrik/update_issues/tracelog.exe -Run Process Monitor (Procmon.exe), click on Filter and check “Enable advanced output” -Run Wireshark, click on Capture > Interfaces, choose the active interface and click “Start“ -Create “C:\log“ folder (it needs to exist before running the tracelog utility) -Run the command prompt with administrator permissions from the folder where you saved the tracelog.exe utility -In the command prompt, run this command: tracelog -start updater -guid #f329ae9a-556d-4934-920f-234e835d9ece -f c:\log\update.etl -append -UsePerfCounter -flag 0xff -level 0xff -At this stage, all logging has started, now go reproduce the update issue (run the VSD update and wait till it fails, mark down the exact error and the current time along with your timezone) ....as soon as i get the error again i will do this.... getting to a point where something that should be transparent and work without issue...getting to be an awful lot of work on users ends to get your product working Edited May 25, 2016 by slarkins Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,128 Posted May 25, 2016 ESET Moderators Share Posted May 25, 2016 Hello Slarkins, I'm sorry that we request such amount of logs, but many users are reporting it, but no-one has supplied us yet with all the logs we need to check the issue as there are more theories, what might be causing it. Once fixed, it should work transparently again. Probably the most important change is that we need a Procdump of ekrn from such state as well. Regards, P.R. Link to comment Share on other sites More sharing options...
slarkins 5 Posted May 25, 2016 Share Posted May 25, 2016 does it help for me to tell you that the update downloads....but on the second "update screen" where it shows 0/2 or 0/3 (not sure what the second scrren does...maybe apply the actual download)...it usually fails between 1/2 and 2/2...hangs right after 1/2 then goes to failure...the last configuration download in the ERA window for a stuck client....is usllay back a few hours....when the last successful update happened... Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,128 Posted May 25, 2016 ESET Moderators Share Posted May 25, 2016 What we know is that it seems that the update files are downloaded successfully, but the application of them is not successful, so your statement supports that theory, but does not help us to determine to root cause of it. Link to comment Share on other sites More sharing options...
gymmbo 0 Posted May 27, 2016 Share Posted May 27, 2016 I noticed that 98% of my clients are now downloading and reporting successfully. Nothing different was done between yesterday and today on my end other than clearing the cache. Link to comment Share on other sites More sharing options...
Recommended Posts