Kaspersky fails to update

Versions / Builds Affected

20.3

Status

Resolved

Problem Summary

Kaspersky fails to update, causing Failed VSE errors in Dashboard and dumping emails in EmailSecurity/Failedmails folder.

TT / JIRAID

GFIME-2545

How to Identify

Debuglogs: 2017-06-28,14:36:11,480,1,"#00002574","#00000011","info ","autoupdate","response URI: http://cdnupdate.gfi.com//incav2/kaspersky86/c1/kaspersky86_current_version_c1.zip" 2017-06-28,14:36:11,480,1,"#00002574","#00000011","info ","autoupdate","Content-Length: 205900481" 2017-06-28,14:36:42,633,1,"#00002574","#00000011","error ","autoupdate","error: DownloadFilePost2() exception: System.IO.IOException: Von der Übertragungsverbindung können keine Daten gelesen werden: Eine vorhandene Verbindung wurde vom Remotehost geschlossen. ---> System.Net.Sockets.SocketException: Eine vorhandene Verbindung wurde vom Remotehost geschlossen ; bei System.Net.Sockets.Socket.Receive(Byte[] buffer, Int32 offset, Int32 size, SocketFlags socketFlags) ; bei System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size) ; --- Ende der internen Ausnahmestapelüberwachung --- ; bei System.Net.ConnectStream.Read(Byte[] buffer, Int32 offset, Int32 size) ; bei System.IO.BinaryReader.Read(Byte[] buffer, Int32 index, Int32 count) ; bei GFI.Common.AutoUpdate.AuDownload.DownloadFilePost2(CONTEXT& context, Boolean update_downloadcount)" 2017-06-28,14:36:42,633,1,"#00002574","#00000011","info ","autoupdate","AuDownload::DownloadFileDirect()" 2017-06-28,14:36:42,633,1,"#00002574","#00000011","info ","autoupdate","got reponse" 2017-06-28,14:36:42,633,1,"#00002574","#00000011","info ","autoupdate","StatusCode: OK" 2017-06-28,14:36:42,633,1,"#00002574","#00000011","info ","autoupdate","Last modified: 28.06.2017 14:36:42" 2017-06-28,14:36:42,633,1,"#00002574","#00000011","info ","autoupdate","response URI: http://cdnupdate.gfi.com//incav2/kaspersky86/c1/kaspersky86_current_version_c1.zip" 2017-06-28,14:36:42,633,1,"#00002574","#00000011","info ","autoupdate","Content-Length: -1" 2017-06-28,14:36:42,633,1,"#00002574","#00000011","error ","autoupdate","error: unexpected ContentType: text/html" 2017-06-28,14:36:42,633,1,"#00002574","#00000011","error ","autoupdate","error: StatusCode: 200" 2017-06-28,14:36:42,633,1,"#00002574","#00000011","info ","autoupdate","Waiting 381 seconds"

Workaround / Fix Details

Follow the procedure listed below and ensure all steps have been completed to eliminate environmental issues: 1. UAC is disabled on the GFI MailEssentials server. 2. No Backup app or Antivirus is scanning the GFI folders. 3. An update has been triggered from the user interface clicking "Update Now". 4. There are enough resources in the server. RAM or CPU utilization should not go over 75%. 5. A Firewall or proxy is not blocking the update connection. The cause for some customers was a Sonic Wall Firewall blocking Kaspersky content from being retrieved. The problem was related to part of the definition files and not to a port. So, that is why it does not affect all AV Engines. port. So, that is why it does not affect all AV Engines.

Required Actions

If all above do not help, please escalate with a full set of log files.