Virus Signature Version Monitoring sometimes downloading/installing bad info?

[vbroadwater_]

Hi, everyone. We've had this off and on issue for a little over a month now and I wonder if anyone else has seen this. Basically it seems that the auto download/install of new virus signature is sometimes installing bad or corrupt information and then everyone trying to gain access is denied by Host Checker until we force a new download. We're currently running 6.2 R3-1 with ESAP 1.4.5.

A little background:

Before this current version, we ran 6.0R3.1. At the time it seemed to do some sort of checksum on the signature file it downloaded as we'd sometimes see errors in the log that it had a problem and it wouldn't install the file. Did they get rid of the checksum with 6.2?

Also, with ESAP 1.4.2, when it would install a bad file, it seemed to stop the auto download process and someone would have to force it to download the file in order to get it going again. Luckily that doesn't seem to be the case with 1.4.5 though.

[ruc_]

A similar issue (related to validation of the signature file) was fixed in 6.2R4

[vbroadwater_]

Thank you!!! I tried checking out the release notes but didn't see anything. Guess I'll have to go check again and look closer this time. I'm still waiting to hear back from JTAC. They wanted to review the logs, but I'm not sure what they'll find.

I was considering upgrading to 6.3 R3 anyway. Looks like I may be going ahead with that after all.

Thanks again!

[vbroadwater_ · Accepted solution]

Just a quick update - The problem did appear to be related to 6.2R3-1 somehow. We upgraded to 6.3R2 last week and all has been fine. Then this morning I saw in the logs that it couldn't import the signature file because "Invalid signature - parse error". This is how it USED to act before 6.2R3-1. So yaay for some validation!