This error usually ocurrs when there is a failure in the download and the sensor did not detect a specific errors from the scp client/server.
We coded our sensor to detect many of the common forms of error messages, but it doesn't detect all possible errors. So if the sensor saw an error it didn't understand as an error it assumes the file was downloaded and looks for it on the sensor. When it sees it is not on the sensor it generates the error you are seeing.
Things to try:
1) Verify what directory the file is in on your scp server. If the file is in a directory relative to the home directory of the username you are using then place only a single / between the ip address and the directory where the file exists.
If, however, the file is in a directory relative to the root directory of the system then you need to use 2 /s between the ip address and the directory where the file exists.
For example a user joeuser has a home directory /home/joeuser. Joe puts the update in the /home/joeuser/updates directory on his scp server 10.1.1.1. You see that the updates directory is a subdirectory of his own home directory.
So he issues the command:
upgrade scp://joeuser@10.1.1.1/updates/IDS-K9-sp-4.0-1-S29-.rpm.pkg
If he instead had placed the updated in the /tmp directory on his scp server then he would have needed to use 2 /s because the /tmp is not a subdirectory of his home directory.
upgrade scp://joeuser@10.1.1.1//tmp/IDS-K9-sp-4.0-1-S29-.rpm.pkg
NOTE: Notice the 2 /s between .1 and tmp
2) If the above is not the cause then try the following:
a) create a service account if you don't already have one
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/hwguide/hwchap9.htm#587923
b) login with the username for the service account
c) Now execute an scp to copy the file to the service account's home directory and look for any errors from the scp server or scp client:
scp joeuser@10.1.1.1:/tmp/IDS-K9-sp-4.0-1-S29-.rpm.pkg .
NOTE: The scp command in service account does NOT need the / for subdirectories of the user's home directory and uses only a single / for directories relative to the root directory unlike in the upgrade command.
