To stay updated on your favorite discussions, please create an account or log in. Then, click the Bookmark icon to subscribe and receive notifications.

Scanner Manager Update 15 August Causing "Disk Errors" with Windows 2008 Servers?

Zoltar
Zoltar Posts: 23 Security Scout
in Business Suite

Hi

 

Since we received a scanner manager update on 15 August, I am now getting reported issues with my various Windows 2008 servers?

 

I am getting  "an error was detected on device \Device\Harddisk0\DR0 during a paging operation".

These servers are virtual servers using a number of different LUNS on different hosts.

 

Once the error is received, the server become unresponsive and also unable to even logon.

 

The only way to "fix" the issue is to power off the server & restart :<(

 

Unable to get through to support a the moment - phone keep going dead.

Alan

Comments

  • KoNXuRo
    KoNXuRo Posts: 3 Security Scout

    We are having exactly the same issue here.

     

    It was difficult to correlate Fsecure update with disk issues on VMs, but apparently now we are not the only ones...

  • ma-sc
    ma-sc Posts: 5 Junior Protector

    We had the same issue on Windows Server 2003 (only two left in the field) and two Windows Server 2008 R2 servers. After a reboot the server will run for a few hours and become unresponsive again. The Event Viewer on the systems is full with I/O errors...

     

    It seems that the RAM will gets exhausted before the servers crashes.

     

    Product version on Server 2008 R2:  12.00

    Product version on Server 2003: 11.01

  • Hyllegaard
    Hyllegaard Posts: 1 Security Scout

    This is basically a memory leak problem. It occurs after the update of F-Secure Scanner Manager.

    This is happening on all our servers.

     This is also on 2012 and 2012R2 servers

  • Vad
    Vad Posts: 1,069 Cybercrime Crusader

    Hello everybody,

     

    We are currently working on a fix with priority. It will be released in the channel ASAP.

    Sorry for inconvenience.

     

    Best regards,

    Vad

  • Askoik
    Askoik Posts: 28 Security Scout

    We have these disk errors on Win 7 Pro desktops. Hopefully your fix will do the trick also on this OS.  FSDIAG is sent to your support.

  • Askoik
    Askoik Posts: 28 Security Scout

    Hi!

     

    Could you tell us, when did you originally release faulty update, and when did you release the final fix? How can I check, that I have correct fix installed?

  • Vad
    Vad Posts: 1,069 Cybercrime Crusader

    Faulty package was 'F-Secure Scanner Manager Update 2018-08-15_01', published 15.08.

    Fixed package is shown as 'F-Secure Scanner Manager Update 2018-08-16_01', publish time: 16 Aug 2018 23:23:47 +03.00.

    Best regards,

    Vad

     

  • KL3
    KL3 Posts: 2 Security Scout

    Hi!
    How about all 10.x versions of corporate products?
    Our F-Secure Client have 'F-Secure Scanner Manager Update 2018-08-16_01', but still have errors.

  • Vad
    Vad Posts: 1,069 Cybercrime Crusader

    Hello KL3,

     

    Please, be more precise. What product/version do you have?

     

    Best regards,

    Vad

  • gbeud
    gbeud Posts: 3 Security Scout

    Hello all,

     

    Same here from  the 'F-Secure Scanner Manager Update 2018-08-15_01'.

     

    The 'F-Secure Scanner Manager Update 2018-08-16_01' was applied, I don't know yet if the problem is still alive but from the update, I am spammed with : 'No scanner engines loaded and enabled. Virus protection is disabled' emails.

     

    Regards,

  • KL3
    KL3 Posts: 2 Security Scout

    Hi!

    Our F-Secure Client Security product/version is 10.00 

  • Vad
    Vad Posts: 1,069 Cybercrime Crusader

    KL3,

     

    We are not verifying our channel updates on such old version. Please upgrade your machines to the supported version.

     

    Best regards,

    Vad

  • Vad
    Vad Posts: 1,069 Cybercrime Crusader

    Hello gbeud,

     

    What F-Secure product/version do you have?

    Did you try to restart the machine after 2018-08-16_01 update installation?

     

    Best regards,

    Vad

  • gbeud
    gbeud Posts: 3 Security Scout

    FSPM is 12.40.
    FSCS are going from 11.00 to 12.33.

    FSSS are 12.00, 12.11 and 12.12.

    Yes we restarted some VM servers from a first crash during the 15's night.
    Others crashes in the 16's evening, the 2018-08-16_01 update was applied at 22:30. We restarted servers this morning and waiting for anormal behaviors.

  • Vad
    Vad Posts: 1,069 Cybercrime Crusader

    gbeud,

     

    This versions should be recovered properly by the 2018-08-16_01 update. If you still have issues like "No scanning engines loaded and enabled" after 2018-08-16_01 update and restart, please, contact support. We will need diagnostic information from affected machine(s) for further investigation.

     

    Best regards,

    Vad

  • gbeud
    gbeud Posts: 3 Security Scout
    OK thank you for your help.

    The email spamming don't concern the crashed servers.
    It applies only to FSCS and it's a "false positive". I checked on some clients and real-time protect, FSGKHS, or everything else is still running despite the email.

    Factually, it's a just an email spamming while nothing is going wrong and I suspect the 2018-08-16 update to be the source.

    It seems to be a communication issue between the management agent and FSCS.
  • Vad
    Vad Posts: 1,069 Cybercrime Crusader

    gbeud,

     

    In most cases when we had received similar reports, they were related to clients which have OSA module installed, and for some reason it lost communication with SRS server(s).

    This can also happen if Scanner Manager update installation failed, but it seems not to be your case.

     

    Best regards,

    Vad

  • Zoltar
    Zoltar Posts: 23 Security Scout

    Hi F-Secure,

     

    Since the "fix" was applied last night, the server environment running V12.xx products does seem to have returned to normal.

     

    But the question remains how did this scanner manager update pass its quality control checks before release?

     

    Also why does F-Secure not at least post on the community when a Scanner manager or unltralight update is released?

     

    At least then we would be forewarned if things start to go wrong rather than us floundering in the dark wondered “what has changed” or "gone wrong" as our servers crash all around us!

     

  • alphanumerics
    alphanumerics Posts: 1 Security Scout

    This issue originally affected one of our 2003 servers with a memory leak.  After the 8/16 update, all of our servers running 12.11 reported "No Scanners Available".  The servers, physical or virtual, that were affected by this update could not be reached through RDP or VM console.  We had to power down and restart servers in order to access them again.  

  • Vad
    Vad Posts: 1,069 Cybercrime Crusader

    Hello alphanumerics,

     

    Are your servers still showing "No scanners Available" after restart?

     

    Best regards,

    Vad

  • KoNXuRo
    KoNXuRo Posts: 3 Security Scout

    I'm still waiting for an asnwer from Customer Support since yesterday, let's see if anyone here knows the answers...

     

    1.- I'd like to see from a central location if the "F-Secure Scanner Manager Update 2018-08-16_01" has been applied to the agents in the servers. Is this possible? Is there any place in Policy Manager to see this?

     

    2.- I'd like to ONLY update virus definitons databases in the servers, and stop automatic softwares updates like this one, so this does not happen again. We'll control these updates manually.

     

    Any help on these would be greatly appreciated.

     

    Thanks!

  • Askoik
    Askoik Posts: 28 Security Scout

    1. I haven't seen this in PMC. My guess is, that only way to check version is:

    C:\ProgramData\F-Secure\Logs\FSAUA\fsaua.log

     

    2. Are you sure your way is safe enough? Isn't is possible that they release also an faulty virus definition, which alarms false positives of some Windows components and quarantines those.   :)

  • Vad
    Vad Posts: 1,069 Cybercrime Crusader

    KoNXuRo,

     

    1. You can find the information about installed DB updates in FSAUA statistics for each host in PM Console: Status tab (Advanced view) > F-Secure Automatic Update Agent > Statistics > Downloads > Installed packages.

     

    2. It's not possible to configure separate behavior for different update channels.

     

    Best regards,

    Vad

  • KoNXuRo
    KoNXuRo Posts: 3 Security Scout

    Hi Vad,

     

    Thanks for your response.

     

    I assume then that:

     

    1.- There is no way to see the version of the F-Secure Scanner Manager Update in all hosts at a glance, I need to go one by one checking the version. No possible query to the database here?

     

    2.- It's impossible to get updates to the virus definitions without receiving updates for the software as well.

     

    Is this correct?

  • Vad
    Vad Posts: 1,069 Cybercrime Crusader

    1. You can actually create a report from PMC. Select the domain in Policy domain selector, and then select "Reporting" from context menu. In "Report type selector" select "Status", in "Product selector" check "F-Secure Automatic Update Agent" check box.

    Press "Export" button and export to csv file. After that you can filter it in Excel by the beginning of the update name, like "F-Secure Scanner Manager".

     

    2. This is correct.

     

    Best regards,

    Vad

  • etomcat
    etomcat Posts: 1,172 Firewall Master

    Hello,

     

    I just wanted to say I feel sorry for eventually causing all that mess.

     

    Yours Sincerely: Tamas Feher, Budapest, Hungary.

This discussion has been closed.

Categories