Description

The anti virus update is failed, even the device has already configured the name server and the device has ability to resolve the FQDNs.


  name-server {

    202.96.209.133;

    202.96.209.5;

    8.8.8.8;

    8.8.4.4;

  }

Symptoms

{primary:node0}

root@test> request security utm anti-virus sophos-engine pattern-update 

node0:

--------------------------------------------------------------------------

Anti-virus update request results: av_mgr: pattern updater 6579 is started, downloading from https://update.juniper-updates.net/SAV/.


node1:

--------------------------------------------------------------------------

Anti-virus update request results: av_mgr: updater exiting on secondary node


{primary:node0}

root@test> show security utm anti-virus status 

node0:

--------------------------------------------------------------------------

 UTM anti-virus status: 

 

  Anti-virus key expire date: 2027-04-25 08:36:02

  Update server: https://update.juniper-updates.net/SAV/

      Interval: 1440 minutes

      Pattern update status: av updater is running

      Last result: download version file failed

  Forwarding-mode: continuous delivery

  Scan engine type: sophos-engine

  Scan engine information: last action result: No error

  Anti-virus signature version: 1.13 (1.02)


node1:

--------------------------------------------------------------------------

 UTM anti-virus status: 

 

  Anti-virus key expire date: 2027-04-25 08:35:56

  Update server: https://update.juniper-updates.net/SAV/

      Interval: 1440 minutes

      Pattern update status: next update will be synchronized from primary node

      Last result: new database downloaded

  Forwarding-mode: continuous delivery

  Scan engine type: sophos-engine

  Scan engine information: last action result: No error

  Anti-virus signature version: 1.13 (1.02)


root@test> show log utmd-av 


Oct 11 09:05:20 av_mgr: pattern updater 34099 is started, downloading from https://update.juniper-updates.net/SAV/.

 

Oct 12 09:05:20 av_mgr: pattern updater 1981 is started, downloading from https://update.juniper-updates.net/SAV/.

 

Oct 13 09:05:20 av_mgr: pattern updater 70129 is started, downloading from https://update.juniper-updates.net/SAV/.

 

Oct 14 09:05:20 av_mgr: pattern updater 38037 is started, downloading from https://update.juniper-updates.net/SAV/.

 

Oct 15 09:05:20 av_mgr: pattern updater 6011 is started, downloading from https://update.juniper-updates.net/SAV/.

 

Oct 16 09:05:20 av_mgr: pattern updater 74641 is started, downloading from https://update.juniper-updates.net/SAV/.

 

Oct 17 09:05:20 av_mgr: pattern updater 42603 is started, downloading from https://update.juniper-updates.net/SAV/.

 

Oct 18 09:05:20 av_mgr: pattern updater 10528 is started, downloading from https://update.juniper-updates.net/SAV/.

 

Oct 19 09:05:20 av_mgr: pattern updater 78327 is started, downloading from https://update.juniper-updates.net/SAV/.

 

Oct 20 09:05:20 av_mgr: pattern updater 46357 is started, downloading from https://update.juniper-updates.net/SAV/.

 

Oct 21 09:05:20 av_mgr: pattern updater 14312 is started, downloading from https://update.juniper-updates.net/SAV/.

 

Oct 22 09:33:42 av_mgr: pattern updater 84652 is started, downloading from https://update.juniper-updates.net/SAV/.

Solution

The root cause is due to the primary name-sever to resolve the anti-virus FQDN encountered large latency here and then caused the manually update database is failed. When change the primary name server to 8.8.8.8, the Sophos database update became normally.

Modification History

2024-11-05 : Article Created