Repository Pull of DAT 5151 fails

[PhilR]

Getting this error:

Downloading package Current\AMCORDAT2000\DAT\5151.0\0000

Failed to validate repository TrellixHttp. File C:\Windows\TEMP\nai488B.tmp\00000002\content-000D002B-000024-x86_64.zip found hash AC58078CC87D25ECD526680F94F29A35EBED0B03, expected hash 3FA61390E5....

Edit:

Was using update.nai.com/Products/CommonUpdater2

Changed to update.nai.com/Products/CommonUpdater

and the pull worked

Phil

[Chris_Heys]

I had exactly the same problem with the CommonUpdater2 repository last night, showing the same unexpected hash values.

The CommonUpdater2 address will have several physical representations depending where in the world you are.

The validation failure happens very occasionally when the remote Trellix repository is between DATs by not being fully purged/refreshed from its previous state.  This problem used to happen quite frequently to me in 2019/2020, and I raised a call which Trellix looked into, along with their hosting provider Akamai.

The new DAT is generally available from about 19:00 UTC/GMT, as this article states, https://kcm.trellix.com/corporate/index?page=content&id=KB55986.  However, sometimes the DAT release is delayed or takes longer than usual to replicate around.

Sometimes therefore it is a timing issue, but clearly there was a problem after yesterday evening's update which left the repository in an invalid state for an extended period.

[PhilR]

Glad it wasn't just me.

At least 14 hours passed between me first noticing and my last unsuccessful attempt, so I think I gave it enough time for the mirrors to sync up.

Cheers,

Phil

[Chris_Heys]

Something has changed recently.  We've now had these types of failures on the last 3 consecutive nights.

I think Trellix needs to purge/refresh their repository contents as there is no problem with our internet connectivity.  I will now raise a call with them as we are 3 days out of date and still can't update our ePO repositories from update.nai.com/Products/CommonUpdater2.

[cdinet]

Can you send me your SR number please in private chat?

[Schnuecks78]

Same problem here, i raised a sr too.

We had this problems a few days ago and switched tu CommonUpdater a that worked, but now we switched through all 3 CommonUpdater all the same error.

I downloaded the dat packages manually and checked it in and until now no error.

[Chris_Heys]

Thanks, yes downloading the V3 DAT package from https://www.trellix.com/en-us/downloads/security-updates.html, and checking in manually is clearly the workaround when the "source to master" replication from Trellix is not working. I wish I had thought of that sooner.

With the SR case I raised, the root cause could not be investigated before I submitted a WebMER.

Once I had done this, I was contacted to say this was a known P1 case with lots of customers having raised the same issue.  A fix is anticipated in the next 1-2 days.  In the meantime the workaround is to download and check-in the DAT package manually, as above.

An obvious question is how to know when there is a widespread issue like this. I can see no SNS bulletins about this, and I don't know of any "status" page that might be useful here.

[ree5g]

If not already done so, create an automatic response in epo to email when there is a main repository update failure. This won't alert if there's a widespread issue but will help identify if there's an issue in your enviroment that requires investigating