When Can I Expect Clients to Register a Pushed VPS Update?

[KDibble]

Using SOA 1.3.3.35 with Endpoint Protection 8.0.1603. I have 185 licenses which expire in June 2018, and currently 122 managed computers.

SOA is running on a Windows 7 Ultimate SP 1 32-bit machine (NOT a server OS).

NO FIREWALLS are in use on either the SOA host or any of the clients.

Every day some small number of randomly-selected machines shows a yellow "question mark" in the SOA network listing. If I physically go to these machines, Endpoint Protection will claim they are unlicensed. Attempting to obtain the license from the client results in a "Contact your system administrator" message.

After working through this with Avast Support for more than a week, there is no resolution, however the assumption is that the problem is likely due to the maximum 20 inbound concurrent connections in Windows 7. Almost all of the machines attempt to connect to the SOA between 8 am and 9 am every morning, and probably most of them make the attempt within the same 5-minute period around 9 am, so it seems at least possible that a few of them would time out as a result of the connection limit. The "problem" machines are always random; they are never the same every day. However, I am now seeing a range of VPS versions crossing several days on the clients (oldest currently 150702-2; newest 150706-1). I can live with some machines being one update late, but missing several updates in a row concerns me.

So I ran a job to push VPS updates: "Job Type: Maintenance; Job Selection: Definitions update; Schedule: Immediately", as instructed by Avast Support staff, who say that pushing VPS updates will also cause clients to update their licenses. The job completed successfully. I logged out of the SOA, waited a few seconds, and logged back in. In the SOA Network display, there was no change in VPS definitions on any of the clients, and the same "question mark" machines remained.

Avast, being developed in a language other than English, does not always have clear English descriptions of its features in the SOA; in particular, the description of various "updating" job options is ambiguous.

So these are my questions:

1. Is this the right job to get an immediate VPS push?

2. Is this the right job to force clients to update their licenses?

3. How long should I expect to wait before the SOA registers these updates?

Thanks for any help.

[Avosec-UK]

1. Is this the right job to get an immediate VPS push?
- AFAIK there are no jobs to push the VPS updates for SOA. The job you were running was to update the Mirror server. The clients on their side are by default configured to check with the mirror server for new versions every 15 minutes and update if available.
2. Is this the right job to force clients to update their licenses?
- If you want to update the licenses, try to restart the Avast NetClient Service on the client machine. This forces the clients to connect to the console to report their status as well as pick-up any new settings or licenses.
3. How long should I expect to wait before the SOA registers these updates?
- The moment they connect to the console.

Please:
1. Check and let us know what are the Mirror Server details in ADMIN > Mirror.
2. Check and attach the Setup.log located under C:\ProgramData\AVAST Software\Avast\log on one of the clients with the problem.

[KDibble]

After waiting an hour, all but one of the clients that are NOT reporting a problem got the VPS updates. The two clients showing yellow question marks today did not get them.

ADMIN>Mirror shows:

Program Version: 8.0.1603
Virus Definitions: 150706-1
Last Update Time: 7/6/15 9:15:55 AM
Last Mirror Status Check: 7/6/15 12:06:17 AM (just three minutes ago as I write this; I'm on USA EDT)
Mirror Status: Done
Error Code: OK (nothing to do) (20000001)

I tried to post Setup.log from one of the machines, but it is 2.4 MB, and the website insists that my "attachment cannot be saved". If you have an alternate way of receiving it, I'd be glad to send it.

Over the course of a week, Avast support staff in Prague insisted several times that the job I described would push an update to the clients.

I thought that all settings in the SOA override those settings in the clients. In the SOA, auto-update interval is set to 120 minutes.

I can "fix" the problem machines by uninstalling and reinstalling Avast. Restarting the service on them would be faster. The problem, though, is to avoid physically visiting the machines at all. Every morning there are between 2 and 7 machines showing this "problem". Having to visit all of them is not a solution. So I hope we can find a better one involving the console actually doing its job correctly.

Thanks for all of your help.

[Avosec-UK]

I believe that if you just archive the file it will get to a reasonable size, sine it's just a text.
Alternatively try with wetransfer.com

You don't have to access every machine physically to restart the service.
You can just use the Services MMC Snap-in to connect to a remote computer and restart it remotely.

Before we jump onto troubleshooting the update process, can you make sure that this your problem.
If you hightlight a machine in the Group view, you will see and Edit button. Click on it and check if it isn't a real-time shield being disabled on the client computer.

[KDibble]

There are four machines showing yellow question marks today. Of the four, using the edit button, all are showing "File system shield inactive". However, they all show "last update" for that shield as occurring earlier this morning. One of them is also showing VPS definition 150701-2 (the machine was not running yesterday when I did the VPS push). This machine shows "Virus definitions last updated" on 7/1/15. The rest are showing VPS definition 150706-1 with "Virus definitions last updated" early yesterday morning, BEFORE I did the VPS push. All of these machines also show as "online".

In itself, this raises a couple of questions:

1. If the "last update" under "File system shield" is not the VPS, then what, exactly, was "updated" this morning?

2. If my VPS push actually succeeded yesterday, as Avast reported that it did, then why are the machines with current VPS definitions showing "Virus definitions last updated" several hours before I executed the push? (Machine clocks on the server and client machines are correct within a few minutes.)

Beyond that, I just physically visited two of the machines discussed above and opened the EndPoint Protection client. One has the most recent VPS; the other has an older version. Both are showing "some shields are turned off", but both are ALSO showing "subscription expired". Attempting to turn on the shield in the client fails under those circumstances.

I should point out that I have program updates turned off in the SOA for this group; the machines only receive VPS updates automatically.

I also need to mention that any "fix" for the problem with these machines is not permanent. They may be randomly chosen again to show a problem within a few days of the "fix". It's just that, due to the random nature of the issue, I have yet to see the same machine report a problem two days in a row.

I have a SAMBA 3 (NT-emulation) domain running on a Linux server, not a true Windows domain. Only some of the Windows domain administration tools work with this domain, so I would be surprised if the Services snap-in would work. It's worth investigating for future purposes, but I would add that having to restart services on several machines every day, even remotely, isn't a very good solution to this problem.

I zipped the Setup.log and tried to attach it to this message. This failed; "zip" is not an allowed extension, nor is any other archive file extension. Wetransfer.com appears to have a learning curve and a download requirement (I don't know for sure; I didn't go further than the "get wetransfer" button), so I would just as soon not deal with that sort of thing.

So I renamed the file to a .png extension, which should be acceptable. Just remember to rename it back when you get it. If that doesn't work, perhaps you could send me a private message here at this board with an email address that I can send the file to?

Thanks for all your help.

[Avosec-UK]

The updates aren't the issue for you. It is the File System Shield being inactive.

This might be explained by the fact the Avast client can't validate your license.

Can you let me know how many products of Avast do you see in: SOA > ADMIN > Subscription.

Kind regards,
Daniel

[KDibble]

I think the answer to your question is "1".

ADMIN>Subscription shows:

Product: avast! Endpoint Protection Suite
Product Type: 1
License Count: 185
Subscription valid till: 6/14/2018 2:35:07 AM

This is the only product listed in ADMIN>Subscription.

I would add that this license was provided directly to me by Avast Support in Prague, after the tech determined that the renewal subscription provided to me some days earlier by my reseller was somehow "incorrect". The tech also increased the number of licenses from 175 to 185 as a test of some sort.

Thank you.

[.: Mac :.]

If a license issue, you may see errors to this effect in the computer checkin log (under Admin > Computer Login Audit Trail).  Usually you see "Computer Banned" or similar if the console is denying the connection

[KDibble]

I have 15 "pages" of Computer Login Audit Trail. There are zero (0) instances of a login failure or rejection. All logins were successful, including those of the three machines that are showing problems today.

Thank you for any help.

[KDibble]

As no one has added anything for a couple of days, I will just ask:

Does everyone agree that what I am seeing could be because the SOA host computer's maximum concurrent inbound connection limit is being periodically exceeded?

Or is there some other explanation?

Thanks

[Avosec-UK]

Most likely not.

You wouldn't see them connected at all, if the connection limit was reached.

Do you have a scheduled Deployment job by any chance?

[KDibble]

No, no deployment job scheduled.

Well the only other possibility offered by Avast tech support is vague "network problems". This would be bogus, because these machines have no other problems accessing either resources on the network, or the internet which is provided through the network.

The problem started when the SOA started warning me about impending license renewal. It has continued through the replacement of the license (several licenses, actually, including one provided directly from Prague). It would seem there is some relationship between this situation and the SOA's handling of license renewals, which, as is clear from this forum, is fraught with many problems.

I think you are also ultimately correct that the SOA has NO scheduled job to push VPS updates to clients; the only available job just goes out to the Avast corporate servers and updates the SOA mirror.

The possibility remains that there is some incompatibility with a SAMBA 3 domain which has only begun to rear its head as the number of clients has increased. (The SOA does not really "see" my domain completely; if I try to set up a deployment job, it doesn't offer me any options in the "Domain" drop-down.)

A long time ago someone suggested that I go to the Enterprise server instead of the SOA. Would that be likely to solve my problem?

Thanks.