I get a problem with both Http and FTP update of master repository:
What could be the reason of this ? IT has worked well before, but since this weekend it is giving errors all the time.
Maarten van der Schrieck
I have seen this error before "...site ftp.nai.com:21, error code 10054 (An existing connection was forcibly closed by the remote host.)" and it had something to do with either the firewall or gateway. Also, double check EpoApSvr.log - it may provide some additional troubleshooting information.
Very strange, when I look at the firewall I can see the traffic is blocked due to a Trojan at McAfee site. We have now excluded the IP from the McAfee server and now it is working.
Old KB - same type of error-
DAT download blocked by SonicWall Gateway scanning Technical Articles ID: KB58039 Last Modified: 7/27/2015
and perhaps the same type of reason/cause-
Cause: The Gateway is triggering on the McAfee DAT .zip or .tar file because the ReadMe.txt file contains the EICAR anti-virus test string (www.eicar.com).
Only difference is that it is now finding the following virus that is the reason for our Sonicwall to block the traffic: MalAgent.I_14172 (Trojan)
Putting the McAfee IP in the exclusion list of the antivirus gateway of the Sonicwall solves the problem.
We are getting a failure to Update the Master Repository as well!
It has been failing for a few weeks now.
Here is a snapshot of the EpoApSvr.log file
As you can see, the first three files downloads and get verified successfully but the amupdate.dll file gets downloaded successfully but fails the file size verification.
The FTP site has this file at over 2GB but downloads successfully at 2KB?
The download then fails and the update stops!
As mentioned in the following KB article , we have tried to delete the "current" folder containing the amupdate.dll file and nothing changed.
The files are not even being properly downloaded to our ePO server.
Any help would be appreciated.
Hare you tried to manually download the file:
Read this KB article:
At our site it was not the Eicar virus, but the MalAgent.I_14172 (Trojan)
Just check your firewall what happens with the traffic from your EPO server or your client. to the server from McAfee. THis was for us the way to figure out what was wrong.
You were all correct!
Tao, I could not manually download the DLLs or EXEs from the server. Firewall blocked message!
Maarten, as you can see above, our environment was given a modified firewall rule set that was blocking the downloads of DLLs, EXEs and executable files.
Rule set was modified and all is fine now.
Thank you all!