All Deployments reporting "Thumbprint database files are stale "
BWC
Cybersecurity Overlord ✭✭✭
Hi,
today a couple of customers reported that the Monitoring of the Email Security reported "Thumbprint database files are stale" which is one the annoyances of SNWL Email Security.
This happens every now and then but today ALL Deployments are affected, running 10.0.2 up to 10.0.10.
Is there any trouble with the backend, is this already known? Will it fix itself, or do we have to rebuild the DB again?
Diag Page shows between 0 (zero) and 2 (two) TPD files pending, GeoIP (IG) only. Looking not that bad to me, IMHO.
--Michael@BWC
Category: Email Security Appliances
0
Answers
I see this problem upgrading to 10.0.10.6287. Are you saying that it does not depend on the upgrade?
Hi @fabybaruz it looks that way, having two deployments still on 10.0.2 and they are freaking out as well today. Another EVAL VM from a support case which I forgot to poweroff running 10.0.6ish was complaining.
Do you see the same messages since this morning (around 3:40am GMT).
I already restarted the services, but did not changed anything, every hour the warning message comes up.
--Michael@BWC
I'm waitng for the support.
I've the same problem on two VA to the lastest firmware
Fabiano
It is a backed issue.
They have been informed and are looking into it.
You need to do nothing on your end.
David Wilbur
Technical Support Senior Advisor, Premier Services , SME Email Security
The support response
"We appear to have an issue right now where DV thumbprints are not being handed out and updated. There is no real impact on any customers other than they are getting this alert. You can safely ignore it for now."
mmmmm
Issue seems to be resolved since yesterday around 3pm GMT.
--Michael@BWC
@David W all of my deployments are warning about stale Thumbprints again, this is very confusing for my customers. I guess it's a Backend thing again?
--Michael@BWC
@BWC Yes, it is. You can supress the alerts under the System monitoring page if you wish.
I do not have any further information on it at this time and waiting for an update from the backend teams.
David Wilbur
Technical Support Senior Advisor, Premier Services , SME Email Security
@BWC This issue is resolved.
David Wilbur
Technical Support Senior Advisor, Premier Services , SME Email Security
I am starting to get the same messages of stale databases and MySQL is down. Have tried restarting MySQL but it will not stay running. I am on version 10.0.10. I am guessing it is broke again on the backend.
There is presently no back end issue.
If you did a hard reboot, power outage or any number of things it can cause corrupt data.
Please follow the rebuild option in this KB and if you do have issues still please call support and open a case.
Use the one for For appliances: Versions 7.4.6 – 9.x.x
David Wilbur
Technical Support Senior Advisor, Premier Services , SME Email Security
@David W @Gailand are there any known issues with the Backend at the moment? All of my deployments complained about stale Thumbprint databases yesterday at 20:11 (GMT). It stopped 2-3 hours later, but my own appliance is still warning.
Is this an isolated incident and I need to rebuild my database or can it be related to Firmware 10.0.18? I'am the only one running this at the moment, customers are still on the previous release.
--Michael@BWC
@BWC Yes, it was just one DB sever having an issue and was resolved. DC
You do not need to rebuild anything.
David Wilbur
Technical Support Senior Advisor, Premier Services , SME Email Security
@David W thanks for the feedback, I guess it's still an ongoing issue because my and some customer systems still sending the warnings?
--Michael@BWC
@BWC It was resolved yesterday.
You may want to try a reboot and also look at the MLFthumbupdate logs.
If you don't see anything maybe call in and have a tech look into it.
David Wilbur
Technical Support Senior Advisor, Premier Services , SME Email Security
@David W thanks will check, after the reboot the appliance is not responding anymore, have to check tomorrow when I'am at the office. Hopefully it'll recover or I'll be doomed.
--Michael@BWC
@David W @Gailand it seems that "only" the Web Interface isn't working anymore, mail is getting processed. The Thumbprint warnings still occur on most of my customer deployments, I advised them NOT to reboot until I figured out what is going on with my appliance.
Any advice how to recover the Web UI? Currently it's only giving me a Browser Error "Connection Refused" which indicates that it is not listening on Port 443. I already did a redirecthttp off and a rebuildwebroot without success.
--Michael@BWC
Thumbprint Database problems are resolved, no more alerts. Depending on the customer environment it took sometimes longer than for others.
About my WebUI issue, this is still under investigation. HTTP (after running "redirecthttp off" + "rebuildwebroot") was working fine (tricked myself because of the HSTS Policy, needed to use a browser which did not know about it). HTTPS is not working when configured with a Sectigo Certificate, but only after a reboot. When changed from Sectigo to Default SonicWall Cert back to Sectigo HTTPS is working fine.
Certificate was working fine in 10.0.17 and at least shortly after updating to 10.0.18.
--Michael@BWC
Just got a notification regarding different databases. Are these connected to the already know problem?
~~ SonicWall Email Security Alert (10.0.17.7319) ~~
----------------------------------------------------------------
[ Summary: Thumbprint database files are stale ]
Details:
Host Name:
Description: The following thumbprint databases have not
received scheduled updates: AT UC UV
Time Stamp:
Local Time: Mon Jul 11 15:02:48 2022
GMT: Mon Jul 11 13:02:48 2022
@Drimalski if you're getting these messges since Saturday to Sunday night my guess is that the Systems are still trying to catch up. In the meantime all of my deployments don't report any stale DB anymore. It took some systems much longer than others.
@David W and the TSR I spoke with today said that the Backend problem is resolved.
--Michael@BWC
@Drimalski Yes, this would still be related to the same issue.
However only some are seeing it and others are not.
It is being investigated however our backend shows this to be resolved as of Saturday.
As @BWC Stated your may be playing catch up and may still get the alerts until it does finish.
David Wilbur
Technical Support Senior Advisor, Premier Services , SME Email Security
@Drimalski Do nothing. You can suppress the alerts if you want.
Nothing will really be impaired while it is catching up.
David Wilbur
Technical Support Senior Advisor, Premier Services , SME Email Security