How to Force the Cyren AV to Download Complete Update Subsets

03/26/2020 1045 11830

DESCRIPTION:

You may want to download a complete new set of update files for the Cyren AV if you see any alerts relating to the Cyren Anti-Virus Solution (av_cy) under Manage| Server | Monitoring | View Alerts.

CAUSE:

This can be caused by network issues, or by an incorrect update download file being pushed out to the ES Appliance.

RESOLUTION:

If you get a cyren alert as below,

Cyren alert :

---------------------------------------------------------------- 
~~ SonicWALL Email Security Alert (9.0.5.2075) ~~ 
---------------------------------------------------------------- 

[Summary: Anti-Virus engine (av_cy) Failed to download 
Anti-Virus definitions files.] 

Details: 
Host Name: sonicwall.com
Description: An attempt to fetch remote data 
https://av.es.global.sonicwall.com/cyren/5-2/Linux/201805302150/antivir?sn=1234567890&version=9.0.5.2075 to local 
storage 
/opt/emailsecurity/PluginDefault/av_cy/dat/201805302150 
failed. However, the Anti-Virus engine will continue 
to provide virus protection with last known good DAT 
(virus definitions) folder 
/opt/emailsecurity/PluginDefault/av_cy/dat/201805292338. 

Time Stamp: 
Local Time: Thu May 31 08:07:31 2018 
GMT: Thu May 31 05:07:31 2018

Step 1 : Make sure you have sonicwall datacenter FQDN excluded on the firewall from all security services like GAV( Gateway Anti-Virus) , Anti-spywre , IPS , IDS on port 80.

Below are the datacenter FQDN :

eg-update.es.global.sonicwall.com 
plugindefault.es.global.sonicwall.com 
config.es.global.sonicwall.com 
options.es.global.sonicwall.com 
av.es.global.sonicwall.com 
av-updates.mailfrontier.net 

Step 2 : Force update cyren via putty

⦁ Open a SSH client. For example PUTTY
⦁ Input IP address of your SonicWall Email Security appliance , e.g.192.168.168.169
⦁ Press enter and you will see “login as”, login as “snwlcli”(screenshot below)
⦁ At Login prompt, type the Admin Username, e.g. admin, and press enter (Note: In some cases when the Admin username is changed, login will fail. In this case please change it back to admin, by going to Manage | Server | Administration page in the GUI)
⦁ At Password prompt, type the same password that you use for the GUI login and press enter
⦁ Now run the following command: Snwlcli> forcecyrenupdate

NOTE: Please give the appliance time to complete the download of the .dat file, this can vary depending on factors such as connection speed.