cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
14376
Views
26
Helpful
43
Replies

Receiving e-mails about Anti-virus database expired

keithsauer507
Level 5
Level 5

We are recieving e-mails (we I mean IT department) from our Ironport C160 that says Sophos Anti-Virus database on this system is expired.  I checked our feature key and our Sophos subscription doesn't run out until March of 2014 - in which I promptly e-mailed our vendor for a quote :-)

Any idea what this is about, is it an issue?

The Warning message is:

sophos antivirus - The Anti-Virus database on this system is expired.  Although the system will continue to scan for existing viruses, new virus updates will no longer be available.  Please run avupdate to update to the latest engine immediately.  Contact your IronPort support provider if you have any questions.

Current Sophos Anti-Virus Information:

SAV Engine Version      4.84

IDE Serial              2013100502

Last Engine Update      Sat Oct  5 12:53:22 2013

Last IDE Update         Sat Oct  5 06:07:22 2013

Last message occurred 5 times between Sat Oct  5 12:54:46 2013 and Sat Oct  5 12:55:46 2013.

2 Accepted Solutions

Accepted Solutions

Thank you Keith. 

The final action for this one was a backend issue over the weekend w/ the keys server/DB and the communication out to the appliances.

This has been corrected - so, if there are any other customers that are seeing notifications similar, the fix would be to run a force update to have the appliance re-check the DB and communication through to the keys DB:

> antivirusupdate force

Tail the updater_logs, or re-verify the 'antispamstatus sophos' after five minutes, and assure that the serial/time stamps have updated to current time.

-Robert

View solution in original post

Ours picked up the new engine and all is well about 22:37 est yesterday.  Looks good.

Fri May 16 22:37:46 2014 Info: Server manifest specified an update for sophos

Fri May 16 22:37:46 2014 Info: sophos was signalled to start a new update

Fri May 16 22:37:46 2014 Info: sophos processing files from the server manifest

Fri May 16 22:37:46 2014 Info: sophos started downloading files

Fri May 16 22:37:46 2014 Info: sophos waiting on download lock

Fri May 16 22:37:46 2014 Info: sophos acquired download lock

Fri May 16 22:37:46 2014 Info: sophos beginning download of remote file "http://updates.ironport.com/sophos/libsavi/1400293724"

Fri May 16 22:37:53 2014 Info: sophos released download lock

Fri May 16 22:37:53 2014 Info: sophos successfully downloaded file "sophos/libsavi/1400293724"

Fri May 16 22:37:53 2014 Info: sophos started applying files

Fri May 16 22:37:54 2014 Info: sophos updating component libsavi

Fri May 16 22:37:54 2014 Info: sophos updated engine,ide links successfully

Fri May 16 22:37:54 2014 Info: sophos cleaning up base dir /data/third_party/sophos

Fri May 16 22:37:54 2014 Info: sophos sending version details {'sophos': {'version': '4.98', 'ide': '2014051700'}} to hermes

Fri May 16 22:37:54 2014 Info: sophos verifying applied files

Fri May 16 22:37:54 2014 Info: sophos updating the client manifest

Fri May 16 22:37:54 2014 Info: sophos update completed

Fri May 16 22:37:54 2014 Info: sophos waiting for new updates

antivirusstatus

Choose the operation you want to perform:

- MCAFEE - Display McAfee Anti-Virus version information

- SOPHOS - Display Sophos Anti-Virus version information

[]> sophos

SAV Engine Version 3.2.07.392_4.98

IDE Serial 2014051701

Last Engine Update 17 May 2014 02:37 (GMT +00:00)

Last IDE Update 17 May 2014 10:13 (GMT +00:00)

Tony

View solution in original post

43 Replies 43

Robert Sherwin
Cisco Employee
Cisco Employee

Keith -

Have you rebooted the appliance anytime lately?  Sometimes, there are false exipration notices that trigger - if the system starts up and before the appliance returns all services to fully operational after the start-up.

What is the AsyncOS revision running on the C160?  Depending on the revision - you are most likely seeing defect:

https://tools.cisco.com/bugsearch/bug/CSCzv15563

You can also log-in on the CLI and run 'antivirusupdate force', then 'tail updater_logs' --- assure that the appliance reaches out to the updater server and completes the update to the AV serivce.

After five minutes - when you run 'avstatus sophos' - you should be seeing recent time stamps acorss the board on the output.

Hope that helps!

-Robert

No we haven't rebooted it for awhile. 

Up Since:14 Jan 2013 18:39 (GMT -05:00)
(265d 11h 42m 7s)

Today is Monday and the IDE rules updated.  So it fixed itself I guess...

Sophos Anti-Virus Engine05 Oct 2013 16:56 (GMT +00:00)3.2.07.378_4.90

Not Available

Sophos IDE Rules07 Oct 2013 09:36 (GMT +00:00)2013100702

Thank you Keith. 

The final action for this one was a backend issue over the weekend w/ the keys server/DB and the communication out to the appliances.

This has been corrected - so, if there are any other customers that are seeing notifications similar, the fix would be to run a force update to have the appliance re-check the DB and communication through to the keys DB:

> antivirusupdate force

Tail the updater_logs, or re-verify the 'antispamstatus sophos' after five minutes, and assure that the serial/time stamps have updated to current time.

-Robert

Sorry to bump an old thread but i have this today. avupdate force wont fix, reboots done etc. 

When you said "resolved at backend" did you mean Cisco did something? 

 

I have contacted TAC but they are going through the slow process of verifying my contract (again).. Its quite bad really like checking a ER patients credit card before helping! 

Also local vendor are trying for me. 

anyway any help would be appreciated.

Ok Cisco said its a known issue and they will update! 

Hello,

We have the same issue, since today at 0h :

SAV Engine Version        3.2.07.350.1_4.97 (expired)

Product: Cisco IronPort C660 Messaging Gateway(tm) Appliance
Model: C660
Version: 7.6.1-022

Do I have to contact TAC to open a case ?

Thanks,

I'd suggest to do so. That's the only way for the management and other responsibile people to see that something went wrong or was not so well planned.

any update on this

As of 12:00 PM US EST - We are pending an update to the Sophos engine 4.97.  Once this is available, it will automatically download to your appliance(s).

This most likely will be delivered as engine 4.98 here as soon as Q&A is completed.