GraywarePattern update error code 7

[adixon400]

I've gotten this message a couple of nights recently:

GraywarePattern : Pattern Update: The download file was unsuccessful for ActiveUpdate did not receive a return code from the patch process. The update process may have terminated abnormally. The product needs to retry the patch update.. The error code is 7.

Has anyone else had this problem?

Thanks

AD

[wromsait]

Hi Amy,

What version of code are you running on the CSC module?  There are some software issues that could cause this.  CSCtg06921 , and CSCtc37947 are possible causes of this issue.  If you are not running the latest patch 6.3.1172.3, I would suggest to try that.

Hope this helps.

regards,

Wasan

[adixon400]

We are running  software version:   CSC SSM 6.3.1172.3.  The virus pattern and anti-spam patterns were downloaded and instaleld successfully, it was just the Grayware Pattern with the problem. 

[Panos Kampanakis]

Amy,

I would suggest opening a case with TAC. They will be able to help you delete the corrupt patterns files so that you can update the grayware patterns successfully.

I hope it helps,

PK

[Kureli Sankar]

Amy,

See if you can follow this procedure. If you are reluctant then like PK says open a TAC case.

We have seen this issue being caused by a corrupted update package. To  fix this problem, we need to go into the command line and clear out the
temporary update files.

The whole process takes about 10 minutes and you will need to restart  the services on the CSC module (should take just a minute or so and
should not cause any outage).

# First, enable the root account on your CSC module by performing the
following steps.
1. SSH/Telnet to ASA
2. Session into the Module with the command: session 1
3. Login with the username 'cisco' and the CSC password
4. Select Troubleshooting Tools | Enable root account
5. Logout and Login again to 'session 1' but this time using the 'root'
account
(default password is 'cisco')

Then, modify the file system by doing the following:

1) change to the /opt/trend/isvw/tmpfs/AU/AU_Log directory, and remove
all files:

-bash-3.00# cd /opt/trend/isvw/tmpfs/AU/AU_Log
-bash-3.00# rm *

2) Change to the /opt/trend/isvw/tmpfs/AU/AU_Temp directory, and remove
all files:

-bash-3.00# cd /opt/trend/isvw/tmpfs/AU/AU_Temp
-bash-3.00# rm -rf *

3) Change to the /opt/trend/isvw/tmpfs/AU/AU_Workdir
Remove all of the files and directories except the following directories:

    piranhacache
    piranhaengine
    piranharule

-bash-3.00# cd /opt/trend/isvw/tmpfs/AU/AU_Workdir
-bash-3.00# ll
drwxr-xr-x    2 isvw     isvw           60 Aug 18 02:49 AU_Backup
drwxr-xr-x    2 isvw     isvw           40 Aug 20 02:17 piranhacache
drwxr-xr-x    2 isvw     isvw           40 Jul 27  2007 piranhaengine
drwxr-xr-x    2 isvw     isvw           40 Aug 20 02:17 piranharule
-rw-r--r--    1 isvw     isvw         8071 Aug 17 00:00 tmblack.121
-rw-rw-r--    1 isvw     isvw      1575731 Aug 18 02:49 tmwhite.459
-rw-r--r--    1 isvw     isvw      1580567 Aug 20 02:48 tmwhite.461

-bash-3.00# rm -rf AU_Backup
-bash-3.00# rm *.*
-bash-3.00# ll
drwxr-xr-x    2 isvw     isvw           40 Aug 20 02:17 piranhacache
drwxr-xr-x    2 isvw     isvw           40 Jul 27  2007 piranhaengine
drwxr-xr-x    2 isvw     isvw           40 Aug 20 02:17 piranharule
-bash-3.00#

4) Then, exit and then session back into the module using the cisco account and restart the services.

- Please then issue a manual update and ensure the update works. Then  please send me the console log from when you made the changes, and let
me know if the behavior has changed.

-KS

[adixon400]

Thank you for the instructions.  I am a little uncomfortable with doing this myself, so I probably will put in a support.

I can do the first five steps you gave, but I cannot seem to get to a command prompt in order to move around the file system, so I'm obviously doing something wrong.

After step 1, I have to use the command 'en' in order to be able to type 'session 1'.  So then, after I do Troubleshooting Tools, and choose Enable Root account, it says 'The root account has already been enabled'.

then I can choose 'Return to Main Menu', then 'Exit', then 'logout'.  'Remote card closed command session .  Press any key to continue.  Then the file system that I can access is not the correct one.

Can you clarify those?

[Magnus Mortensen · Accepted solution]

Amy,

     To do this you need to enable to root account and make changes to the core file system of the module. We have a handful of bugs that we are tracking for this issue. Please open a case so that a TAC engineer can safely go in an rectify the situation. The bugs in questions are not yet resolved, but we are targetting the fixes for 6.3.1172.4 (no ETA yet).

CSCtj25731 - CSC: Unnecessary clm_debug.log messages generated cause low free memory
CSCtj41993 - CSC: Unable to copy new grayware patterns during update

CSCtg06921 - CSC: catalina.out file may grow large enough to stop pattern updates

My hunch is that it is due to CSCtj41993, but we can make that call during the TAC case.

- Magnus

[adixon400]

Sorry for the delay in responding, but eventually this problem corrected itself.    So the bug fixed worked.  Thanks for the help.