Sophos v5 upgrade problems.

[Geoff]

Yeah, it does seem rather bloated.

[Dos_Box]

Ah! You didn't say it was server side you had the problem. I thought you were on about the clients!

[luke213]

Yes I am using enterprise console on Windows 2000 server.

 

I had a strange feeling it was to do with my hard drive being defragmented but even after defraging it continues to sky rocket. When the server gets too slow I kill the process but it comes back very small at about 5mb but then just keeps rising to 70mb.

 

And yes I have tried a restart, that was the first thing I did.

 

Exactly the same as we have. I rang Sophos and they gave me step by step instructions.

 

1. Stop the "Sophos Certification Manager" and then the "Sophos Message Router" in that order.

 

2. Browse to C:\Program Files\Sophos\Remote Management System\Router

 

3. rename the "Envelopes" folder to "envelopesold"

 

4. Restart "Sophos Message Router" then "Sophos Certification Manager"

 

The problem occurs because the envelopes are the messages sent to the client machines. If you change a lot of settings many times then you get a lot messages being sent to clients. Only one message gets sent at a time and so can get a backlog if machines are turned off. After about half an hour the changes should take place and messages back to a minimum.

 

Hope this helps. I have had to do this about 4 times now!!!!

 

Just one of the reasons we are getting rid of Sophos in April.

[Geoff]

Just one of the reasons we are getting rid of Sophos in April.

 

What alternatives have you considered?

[luke213]

We are really tied to our LEA but they are thinking of getting McAfee. The ERYC has gone accross to McAfee and they seem to like it for schools.

[Geoff]

Ugh. Bad experiences with McAfee in the past.

[luke213]

What sort of problems did you have? Anything we learn, we can report to LEA.

[Geoff]

Ironically, it was rather similar to the situation now with Sophos. Old version (v3 IIRC) worked fine for us (WinNT4 Desktops + Servers, circa '99 '00) and then McAfee released v4. NT 4 machines grinded to halt unless you put about a billion exceptions in.

[MkII]

Just been given the upgrade now - our sims guys have tested it and gave the following fix:

 

For Sims Workstations

 

Right click on the blue shield – open Sophos Anti Virus

Configure - On Access Scanning

Exclusions – Add

Item type – All remote Files

[luke213]

That is what we were told to do, even with the old version of Sophos. As soon as sims .net came out everything takes twice as long.

[MkII]

We have sims.net. I just stopped the live check to get ppl working previously. So is everyone saying that Sophos is a lost cause here?

[Geoff]

Beta quality software. Don't upgrade!

[MkII]

Too late! Aaargh!

[IanB]

I'm finding the new Sophos version an improvement on the old, especially as Sophos are fixing the bugs. I'm running Sophos on a test system though, to get the bugs out before we deploy it on a large scale. I have already found that for SIMS systems I have to exclude background scanning of network files on the clients and the MSSQL folder on the server. It's been working on a (SIMS) training room network for over a month now without problems.

From my experience of McAffee, I wouldn't recomend it. And apparently it is known to cause problems with SIMS upgrades.

Anyone have any experience of Norton AV Corporate?

[spc-rocket]

Hmm interesting comments about sophos blemin our LEA alreday sold us the next version 5.0 i think. The current one v3.x is a horrible thing as well and kills sims.net - it requires so much tweaking that its to the point where you are constanly paranoid of the anti-virus being the problem to any kind of issue. I can't comment on the new version because we haven't installed it but from what the ppl are saying on this topic things are not looking promising.

 

I was recommended Kaspersky by somebody at the tech seminars and its works out cheaper as well. The best thing is that a company comes and installs it for you as well at no extra cost anyway too damn late for us we already bought the version 5 of sophos

 

So people, to sum up what are the major shortfalls when it comes to sims.net and what do we need to exclude in order to get this working correctly. We're gonna try and upgrade to the new version next week. Any things to lookout for ??

 

Ashok.

[john]

We have had no end of problems with sophos since April, I had not anti-v updates all summer long!, Puremessage (the last version) did not even install. I have had the NTRouter.exe actually consume over 10GB of HDD space on a domain controler. Moved it to another server, then that got "eaten" it ate over 1GB of RAM!! My current battle is with DLLloader being left behind after every update of the EM Library. I am running on Server 2000 for it, it worked for about 3 weeks then just started leaving it behind. This is week 4 of Sophos trying to fix it, we have had Dcom errors, fixed them, made new accounts, re-installed the library. We have got it narrowed down to ISA 2004 being the issue, but its set to let everything through both ways for Admins and Sophos, so who know where we will be next!!! I cannot wait for BETT, top of my list to visit are the Anti-V suppliers there to look for something else as my licence expires in April.

 

The only +ive thing I can say for Sophos at present is that the latest puremessage is excellent, it has reduced out spam down by thousands of messages a week, as well as helping remove literally 200 viruses a day from e-mail.

[ChrisH]

Im struggling with this today.... Suddenly when you do a deploy from the console it just brings up the first screen of the sophos setup and expects you to do all the manual clicking. It then keeps losing the path to the files it needs insisting on looking localy than at the source most frustrating.

Ps lets get a list together of all your configs and exclusions etc maybe get it started here and then get it on the Wiki.

[john]

Sounds good for the exclusions, I exclude no folders (on workstations) but remvoe PST, PAB and OST's at present

[ChrisH]

I have just noticed somethign strange. The install screen that pops up is in the format of the old version of Sophos and not sophos V5. It states as being version version 0.0 :? This a clean install of EM console onto a new server and the library says it downloading V 5 ...!!!!

[Michael]

Sophos 5 wasn't an entirely smooth upgrade from 3.xx, but my school was one of three I believe in Birmingham to test Sophos 5 before deploying it to all 500 schools. As far as manageability is concerned, it's a big improvement. I like the new GUI and the ease of configuring scheduled scans and what actions to take when finding a virus all through policies.

 

The other advantage is that it doesn't display a window when updating which the kids used to love clicking on repeatedly, occasionally stopping/freezing the update - the rascals! I have much fewer problems with Sophos 5, however as some of you have pointed out, it is without doubt more resource hungry which is a shame, but the more tools/functionality = the consumption of more memory.

 

Until recently I had minimal problems, however the Enterprise Console suddenly appeared to of frozen in time. At the time, workstations were still receiving updates, but the correct number of IDE files were not showing up in Enterprise Console. In the end I had to stop and restart the Sophos Management Service and suddenly Enterprise Console came to life again!

 

We also runs Sims.NET 7.64, but haven't experienced any incompatibilities or slow down with Sophos 5. We've had the odd problem with Sims.NET and the admin staff always moan, however I think they forget that .NET is far superior to a DOS interface! I guess there's no pleasing some people!

[MkII]

I'm having problems installing v5 using GPO and the instructions found here: http://www.sophos.com/support/knowledgebase/article/3090.html

 

The install prompts for a username & password [both blank]. Anyone know how to bypass that??

[ChrisH]

I guess for stuff like that you are going to need a transform for the MSI.

[MkII]

It uses an exe not the msi strangely.

[ChrisH]

The exe in a lot of cases just starts the MSI if your lucky and you can use the MSI on its own. Im sure I installed manually the other day just clicking on the MSI.

If your deploying through a GPO you must be selecting the MSI it wouldnt let you select an EXE.

[MkII]

There is an MSI in a subfolder. The instructions tho' are for the exe - to quote Sophos:

 

@ECHO OFF
REM --- Check for an existing installation of Sophos AutoUpdate
if exist "C:\Program Files\Sophos\AutoUpdate\ALsvc.exe" goto _End
REM --- Deploy to Windows 2000/XP/2003
\\\InterChk\ESXP\Setup.exe -updp "\\\InterChk\ESXP" -user "USER" -pwd "PWD" -mng yes
REM --- End of the script
:_End

 

You run that from a logon script.

 

I thought I needed to pass those parameters but the installer seems to setup things correctly without ...off to experiment...