hostcheker fails on 6.5R1

[sandyaustralia_]

Hostcheker has configured to allow access if virus definition is out of date not more than 10 updates. but it didnt allow to access till it get updated to latest anitivirus

this is sophos v 7.6.13 and machine had 7.6.12 ,,,

ANY IDEAS AND HOW TO trouble shoot ?

[Lord_Edam_]

Sophos version doesn't check just for "product version", but also "detection identities". (look under the product information bit on the sophos client) sophos release several individual IDE files a day, and if you're more than 10 behind on these files you'll be detected as out of date. It only takes a couple of days to get to the point where Sophos is out of date

[dcrockett_]

Definately check the automatic signature update feature as well. Configure it with your Juniper support username and password and make sure that you test the connection and that it has been updated with the latest date and time. Make sure that you then save your changes once you successfully test the configuration.

You should not have to change the URL, however you can test it with your credentials by pasting that URL into your browser, you should get prompted for your username and password for Juniper support.

I have found that the majority of time that I get this particular error it is due to the failure of the Juniper to update the latest signiture information which is usually due to misconfigured credentials.

[Tessian_]

One thing to take note of is how Host Checker determines if your definition is within X updates as it's very different from the 5.X method of checking # of days old:

Host Checker, assuming you're pulling the AV Definitions Update every hour or so from Juniper, is given the version # of the past 10 updates for the supported AV's it can check definitions for. This means that when Host checker runs, it grabs the DAT version installed on your computer and compares it to that list of 10. If it's on the list, and within the # you specified, then it'll pass. If it's not on the list, then it fails.

This means that if a new DAT is released right now, and you download it before Juniper knows about it, you'll fail the update for not having up to date definitions (Juniper thinks the latest is version 1200, you have version 1201). We used to have this issue a while back, but then we upped the Virus Definition pull to every hour and that mostly went away.