Signature Update Failure - Error Code 52

[J Hefner]

I have a lot of Endpoints that have failed to update their Signatures within the last 24 hours. After looking into it, the Error Code showing for these events is 52 but I have no reference material to address this. 

Anyone know what the error code means? It doesn't appear to transition to anything in the HEX for the Microsoft Document.

[Josh M]

I'm also having this issue with a handful of endpoints. Do you happen to run a self-hosted update server or are you pulling TETRA updates from Cisco cloud?

[Roman Valenta]

Would you guys happen to have any screenshot from the SE Console?

Usually these errors about tetra update will clear out with in 24 hrs if the endpoint is connected to the internet and update interval is to too long. In other words if we miss the "internal clock" window lets say its 1 hour the endpoint will try again in 1 hour if he miss that window it will again try after 1 hour goes by and so on.

[Roman Valenta]

Quick Note:

If the error is presented as Signature Set Update Successful or Signature Set Update Failed this update is related to the BP (Behavioral Protection) engine.

Same rules pretty much applies here as well. We need to make sure that endpoint is connected to the network and we don't block connection to the update server. Again if the issue starts clearing out on its own then there is nothing to worry about.

However to troubleshoot diagnostic bundle in debug will definitely help to at least parse through the logs for clues. 

[Josh M]

That's super helpful info, thanks Roman.

I was just curious because I've rolled out a self-hosted TETRA definition server for our org recently and was double checking to ensure that signatures were being properly updated. Attached below is a screenshot of a few Error 52s from our console that occurred this morning. So far I haven't noticed any adverse impact due to this, but was concerned about future signature set failures.

Signature set update failed

I'm happy to post debug or diagnostic logs if you guys are taking a deeper look into this.

[Ken Stieers]

Is the org server publicly available? Was this machine inside/vpn connected when it tried to update?

[Josh M]

Hey Ken,

No, the update server is only available to internal addresses. No, these are general usage workstations that are accessed on-site via our corporate network.

[Roman Valenta]

OK so this is definitely BP update and its not related to your TETRA on-perm server since TETRA on-perm server only updates TETRA definition. BP is through the cloud. If you keep getting this error and it's not clearing out I would suggest opening TAC case and upload bundle there . I would not post your diagnostic bundle on public forum.

[J Hefner]

Thank you, Roman. It did clear up after about a day. I did file a TAC case on it. Thank you for your quick response here!

[Roman Valenta]

Hi Jason, glad that the issue resolved its self for you.