CISCO WSA upgrade alert error

[DK9]

We have upgraded our S1000v(wsa ) from 14.5.1 to 14.5.2 and upgrade was successful but when we checked the alerts we found an alerts as 

An application fault occurred: ('heimdall/svc.py send_command|195', "<class 'heimdall.exceptions.unknownprocess'="" id="yui-gen27">", "", '[updater/app_thread.py update_handler|1226] [updater/app_thread.py _run_update|790] [egg/webroot_update.py rollback_update|258] [heimdall/svc.py send_command|195]')

but if we see the upgrade logs everything was successful ,any idea guys?

[balaji.bandi]

What is the reason of upgrade ?

may be when you get chance reboot WSA and test it.

Also check the right Interface it try to connect updates - updates.ironport.com 

[amojarra]

Hello @DK9 

It looks like something with webroot_update 

could be due to the reboot after upgrade, webroot was not able to fetch the updates, or something deeper.

I would say:

[1] please review the updater_logs 

[2] please review the webroot logs 

[3] as Balaji advised, maybe reboot will help ( if you are keep seeing this Error ) 

[4] run command updatenow from CLI 

[5] if the issue persist, it is best to open a case, we will review the backend logs . 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++        If you find this answer helpful, please rate it as such      ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

[DK9]

the alert is not repeating. Anyway i will try rebooting .

Can we clear the alerts?

[DK9]

found ths log in updater logs

Wed Apr 24 19:15:19 2024 Info: merlin [instance-id=0] Done with applying new update.
Wed Apr 24 19:15:19 2024 Info: merlin [instance-id=1] applying file "merlin/masters-2.1/10092"
Wed Apr 24 19:15:19 2024 Info: merlin [instance-id=1] applying update on path(/data/third_party/webroot1/db/definitions.mst)
Wed Apr 24 19:15:19 2024 Info: merlin restarting merlin1
Wed Apr 24 19:15:19 2024 Info: avc [instance-id=0] Done with applying new update.
Wed Apr 24 19:15:19 2024 Info: avc [instance-id=1] applying file "update_file_path(avc/1.0.0/dat/default/1707907140) dat_path(/data/db/avc1/signatures)"
Wed Apr 24 19:15:19 2024 Info: avc [instance-id=1] applying file "AVC configuration"
Wed Apr 24 19:15:19 2024 Warning: merlin update failed
Wed Apr 24 19:15:19 2024 Info: merlin Rolling back
Wed Apr 24 19:15:19 2024 Info: merlin rolled back for scanner(merlin) from backup-dir(/data/tmp/tmp40h_AN/merlin/definitions) to working-dir(/data/third_party/webroot/db/definitions.mst)
Wed Apr 24 19:15:19 2024 Info: merlin restarting merlin
Wed Apr 24 19:15:19 2024 Info: merlin rolled back for scanner(merlin1) from backup-dir(/data/tmp/tmp40h_AN/merlin1/definitions) to working-dir(/data/third_party/webroot1/db/definitions.mst)
Wed Apr 24 19:15:19 2024 Info: merlin restarting merlin1
Wed Apr 24 19:15:19 2024 Info: timezones verifying applied files
Wed Apr 24 19:15:19 2024 Info: timezones updating the client manifest
Wed Apr 24 19:15:19 2024 Info: timezones update completed
Wed Apr 24 19:15:19 2024 Info: timezones waiting for new updates
Wed Apr 24 19:15:19 2024 Critical: An application fault occurred: ('heimdall/svc.py send_command|195', "<class 'heimdall.exceptions.UnknownProcess'>", "<UnknownProcess command='RECYCLE' child_name='merlin1' number=None>", '[updater/app_thread.py update_handler|1226] [updater/app_thread.py _run_update|790] [egg/webroot_update.py rollback_update|258] [heimdall/svc.py send_command|195]')
Wed Apr 24 19:15:19 2024 Info: merlin waiting for new updates
Wed Apr 24 19:15:19 2024 Info: Internal SMTP system attempting to send a message to network@sib.co.in with subject "Critical <System> prox: An application fault occurred: ('heimdall/svc.py send_comman..." (attempt #0).
Wed Apr 24 19:15:19 2024 Info: avc restarting avc1
Wed Apr 24 19:15:20 2024 Warning: avc update failed
Wed Apr 24 19:15:20 2024 Info: avc [instance-id=0] Rolling back
Wed Apr 24 19:15:20 2024 Info: avc roll back from (/data/tmp/tmpsYR5z5/signatures) to (/data/db/avc/signatures)
Wed Apr 24 19:15:20 2024 Info: avc restarting avc
Wed Apr 24 19:15:20 2024 Info: avc [instance-id=1] Rolling back
Wed Apr 24 19:15:20 2024 Info: avc roll back from (/data/tmp/tmpsYR5z5/signatures1) to (/data/db/avc1/signatures)
Wed Apr 24 19:15:20 2024 Info: avc restarting avc1

[amojarra]

Thank you @DK9 

if you can see after the Error "Wed Apr 24 19:15:19 2024 Warning: merlin update failed"

merlin is receiving its updates and there are no more Application fault, that should be fine,

again, it is best to have a TAC case to review the backend logs to make sure everything is up and running.

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++        If you find this answer helpful, please rate it as such      ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++

[DK9]

I have opened One will update the same

[DK9 · Accepted solution]

Since the alert came only once we can ignore the issue as confirmed byte TAC.