McAfee Mirror fails

[bizzel]

I've hit a dead end troubleshooting this one so I'm throwing it out here. We've got McAfee VirusScan 8.5 at school and the clients are set up to update primarily from our mirror server via an IIS site. If that fails they fall back to the McAfee repository using HTTP and finally FTP.

 

Our mirror task is set up to run nightly at 3:30am except it has two problems. The first is that, for some reason, it's stopped running. The automatic update of the server's DATs works fine and that's running under the same credentials. If I run it manually it starts alright but it won't run on its own for some reason. The other problem is that it often appears to update successfully (warns about corrupt files but it always redownloads them) but then the clients try to update from it and they fail with "Updates were not applied because the update process encountered an unknown error: SPAMSAFE1000." Interestingly, one of the corrupted files being downloaded is sk_dets.mcs - Spamkiller Detections, I presume, but we don't actually have spamkiller or anything of the sort. Very weird goings on. Has anyone else seen either of these issues?

 

Edit: We're not using e-policy orchestrator and I've tried clearing out the mirror folder to no avail.

Edited January 11, 2008 by bizzel

[SYNACK]

The fact that it runs when you run it manually and not when you are not logged in could indicate that the user account does not have the privileges to run it as a scheduled task in the background. I would make sure that your service account is a member of "Domain Admins" to be sure that this is not the case.

 

Also, just a thought as I don't use McAffe do they have a separate manual update package that you can download. If so this may use full copies of the definitions files and overwrite any corrupted partial files that may have ended up on your server.

Edited January 12, 2008 by SYNACK

[Grommit]

The fact that it runs when you run it manually and not when you are not logged in could indicate that the user account does not have the privileges to run it as a scheduled task in the background. I would make sure that your service account is a member of "Domain Admins" to be sure that this is not the case.

 

Also, just a thought as I don't use McAffe do they have a separate manual update package that you can download. If so this may use full copies of the definitions files and overwrite any corrupted partial files that may have ended up on your server.

 

Have you changed you Domain Admin password recently ?

[PiqueABoo]

I've seen the original mirror tasks not running. Solution was to make a new mirror task - you should only need to set the location of the mirror and the schedule (no guarantees but for me the credentials magically default to the right thing).

 

Don't know about the client issue but the mirror contains file for zillions of different versions of clients. Mirror update download failures for sk_dets.mcs are a regular sight in the logs (ditto for spamcom.dll, su.dll) and that doesn't usually break things i.e. if the mirror task is successful the clients are usually happy downloading from the mirror.

 

Renaming, remaking and repopulating the mirror folder via a manual kick-off of the mirror task is all I can think of, but you say you've done that. Have you also tried un & reinstalling a couple of the clients just in case the trouble is there? Or have you tried stopping your IIS and getting a client to update to see if it still has the problem when that (presumably) falls back to the vendor's update site?

[eean]

Not the same issue, I know, but may be something to try:

My Mcafee (v.8.0) stopped updating on new installs. Old installs, continued to update themselves fine but new installs always came up with update failed. (Nothing had changed at my end) It was the same when they took the update from the mirror or from the internet. In the end, I had to download a superdat update and install that (using silent options) on each client, they then seem able to download the newer updates fine.

[bizzel]

Thanks. I'll give these a shot when Monday rolls around.