NOD32 logs showing trouble reaching server?

[louise]

I just started using Nod32 in August.

The event logs say Update - trouble reaching server and they say
this every hour or two on most days.

Eventually, after several entries like this, with many different
servers tried, I get a a kernal update and everything is fine....

Here is an example of the logs:

Time Module Event User
9/6/2005 14:49:18 PM Kernel The virus signature database has
been successfully updated to version 1.1210 (20050906).
9/5/2005 16:39:07 PM Kernel The virus signature database has
been successfully updated to version 1.1209 (20050905).
9/2/2005 16:01:48 PM Kernel The virus signature database has
been successfully updated to version 1.1208 (20050902).
9/1/2005 14:01:37 PM Update Function: gethostbyname,
parameters: , return value: 11001
9/1/2005 14:01:37 PM Update Update attempt failed (Server
connection failure.)
9/1/2005 14:01:35 PM Update Error connecting to server
www.nod32.com.
9/1/2005 14:01:16 PM Update Error connecting to server
u1a.eset.com.
9/1/2005 14:00:57 PM Update Error connecting to server
u4.eset.com.
9/1/2005 14:00:38 PM Update Error connecting to server
u3.eset.com.
9/1/2005 14:00:20 PM Update Error connecting to server
82.165.250.33.
9/1/2005 13:59:57 PM Update Error connecting to server
82.165.237.14.
9/1/2005 13:59:36 PM Update Error connecting to server
u7.eset.com.
9/1/2005 12:58:33 PM Update Function: gethostbyname,
parameters: , return value: 11004
9/1/2005 12:58:33 PM Update Update attempt failed (Server
connection failure.)
9/1/2005 12:58:32 PM Update Error connecting to server
www.nod32.com.
9/1/2005 12:58:30 PM Update Error connecting to server
u4.eset.com.
9/1/2005 12:58:28 PM Update Error connecting to server
82.165.237.14.
9/1/2005 12:58:27 PM Update Error connecting to server
u3.eset.com.
9/1/2005 12:58:25 PM Update Error connecting to server
u1a.eset.com.
9/1/2005 12:58:23 PM Update Error connecting to server
u7.eset.com.
9/1/2005 12:58:23 PM Update Error connecting to server
82.165.250.33.
9/1/2005 11:58:33 AM Update Function: gethostbyname,
parameters: , return value: 11004
9/1/2005 11:58:33 AM Update Update attempt failed (Server
connection failure.)
9/1/2005 11:58:31 AM Update Error connecting to server
www.nod32.com.
9/1/2005 11:58:30 AM Update Error connecting to server
u4.eset.com.
9/1/2005 11:58:28 AM Update Error connecting to server
u3.eset.com.
9/1/2005 11:58:26 AM Update Error connecting to server
82.165.237.14.
9/1/2005 11:58:25 AM Update Error connecting to server
82.165.250.33.
9/1/2005 11:58:23 AM Update Error connecting to server
u1a.eset.com.
9/1/2005 11:58:23 AM Update Error connecting to server
u7.eset.com.
9/1/2005 10:58:33 AM Update Function: gethostbyname,
parameters: , return value: 11004
9/1/2005 10:58:33 AM Update Update attempt failed (Server
connection failure.)
9/1/2005 10:58:31 AM Update Error connecting to server
www.nod32.com.
9/1/2005 10:58:29 AM Update Error connecting to server
u1a.eset.com.
9/1/2005 10:58:28 AM Update Error connecting to server
u4.eset.com.
9/1/2005 10:58:26 AM Update Error connecting to server
u3.eset.com.
9/1/2005 10:58:25 AM Update Error connecting to server
u7.eset.com.
9/1/2005 10:58:23 AM Update Error connecting to server
82.165.250.33.
9/1/2005 10:58:23 AM Update Error connecting to server
82.165.237.14.
8/31/2005 23:38:42 PM Update Function: gethostbyname,
parameters: , return value: 11001
8/31/2005 23:38:42 PM Update Update attempt failed (Server
connection failure.)
8/31/2005 23:38:40 PM Update Error connecting to server
www.nod32.com.
8/31/2005 23:38:36 PM Update Error connecting to server
u4.eset.com.
8/31/2005 23:38:32 PM Update Error connecting to server
u1a.eset.com.
8/31/2005 23:38:28 PM Update Error connecting to server
u3.eset.com.
8/31/2005 23:38:25 PM Update Error connecting to server
82.165.250.33.
8/31/2005 23:38:23 PM Update Error connecting to server
u7.eset.com.
8/31/2005 23:38:21 PM Update Error connecting to server
82.165.237.14.
8/31/2005 14:37:51 PM Kernel The virus signature database has
been successfully updated to version 1.1207 (20050831).
8/31/2005 10:37:51 AM Kernel The virus signature database has
been successfully updated to version 1.1206 (20050831).
8/30/2005 15:56:24 PM Kernel The virus signature database has
been successfully updated to version 1.1205 (20050830).
8/26/2005 21:55:57 PM Update Error connecting to server
u4.eset.com.
8/25/2005 10:30:11 AM Update Function: gethostbyname,
parameters: , return value: 11001
8/25/2005 10:30:11 AM Update Update attempt failed (Server
connection failure.)
8/25/2005 10:30:09 AM Update Error connecting to server
www.nod32.com.
8/25/2005 10:29:50 AM Update Error connecting to server
u3.eset.com.


Eset tech support has not been helpful. They say I shouldn't run a
Linksys NAT router and Sygate - in other words, only one
firewall...

But more importantly, they suggest it's a firewall setting problem
router and they don't support anything but their own software -
regardless of whether it plays well with others or not.

I've checked and Sygate is definitely letting the nod kernal
through and is set accordingly.

Help?

Louise

 

[Duane Arnold]

I just started using Nod32 in August.

The event logs say Update - trouble reaching server and they say
this every hour or two on most days.

Eventually, after several entries like this, with many different
servers tried, I get a a kernal update and everything is fine....

So? The machine is getting through and getting the update is it not?

Duane

 

[louise]

So? The machine is getting through and getting the update is it not?

Duane

Yes - but I thought this shouldn't happen and maybe something isn't
working right.

Eset tech did not indicate it was "normal" although they've been
unable to pinpoint the problem. If it's not a problem....then I
wont worry about it, but I'd like to be sure.

Louise

 

[David H. Lipman]

From: "louise" <[email protected]>

| I just started using Nod32 in August.
|
| The event logs say Update - trouble reaching server and they say
| this every hour or two on most days.
|
| Eventually, after several entries like this, with many different
| servers tried, I get a a kernal update and everything is fine....
|
| Here is an example of the logs:
|

< log snipped >

| Eset tech support has not been helpful. They say I shouldn't run a
| Linksys NAT router and Sygate - in other words, only one
| firewall...
|
| But more importantly, they suggest it's a firewall setting problem
| router and they don't support anything but their own software -
| regardless of whether it plays well with others or not.
|
| I've checked and Sygate is definitely letting the nod kernal
| through and is set accordingly.
|
| Help?
|
| Louise

Anyone who says "...shouldn't run a Linksys NAT router..." shouldn't be on a help desk !

NAT alone acts to protect the LAN side but there are things you can do like block both TC
and UDP ports 135 ~ 139 on the Router that protect MS Networking behind the Router from
hackers and Internet worms and will prevent MS Networking from leaking out { many Linksys
Routers have this set at URL -- http://192.168.1.1/Filters.htm }

It could a be ISP DNS problem. What you need to do is see if you can access www.nod32.com
outside the software. Use tools such as PING and TRACERT in a command prompt and see if
there a name resolution problem.

 

[Duane Arnold]

Yes - but I thought this shouldn't happen and maybe something isn't
working right.

Eset tech did not indicate it was "normal" although they've been
unable to pinpoint the problem. If it's not a problem....then I
wont worry about it, but I'd like to be sure.

Louise

There can be connection problems to a site for updates. I have seen it at
times with Eset and other sites that do updates. As long as it connects at
some point to the server and does it, it's OK.

Duane

 

[louise]

From: "louise" <[email protected]>

| I just started using Nod32 in August.
|
| The event logs say Update - trouble reaching server and they say
| this every hour or two on most days.
|
| Eventually, after several entries like this, with many different
| servers tried, I get a a kernal update and everything is fine....
|
| Here is an example of the logs:
|

< log snipped >

| Eset tech support has not been helpful. They say I shouldn't run a
| Linksys NAT router and Sygate - in other words, only one
| firewall...
|
| But more importantly, they suggest it's a firewall setting problem
| router and they don't support anything but their own software -
| regardless of whether it plays well with others or not.
|
| I've checked and Sygate is definitely letting the nod kernal
| through and is set accordingly.
|
| Help?
|
| Louise

Anyone who says "...shouldn't run a Linksys NAT router..." shouldn't be on a help desk !

NAT alone acts to protect the LAN side but there are things you can do like block both TC
and UDP ports 135 ~ 139 on the Router that protect MS Networking behind the Router from
hackers and Internet worms and will prevent MS Networking from leaking out { many Linksys
Routers have this set at URL -- http://192.168.1.1/Filters.htm }

It could a be ISP DNS problem. What you need to do is see if you can access www.nod32.com
outside the software. Use tools such as PING and TRACERT in a command prompt and see if
there a name resolution problem.

All the tech "knew" was that you shouldn't run two firewalls. He
seemed to have no concept of NAT etc.

I can ping the site, access it with my browser etc.

Tracert takes 27 hops and it eventually lands at
http://home.euroweb.sk/ and I gather the updates are at this site.

The last exchange I had with eset tech support led to a copy of the
tech's own log files in which Nod32 also tried to update many times
before it succeeded. The tech attributed this to his wireless
internet conection, but I suspect differently.

I guess I'll keep watch on it and make sure it always does succeed
in updating.

Louise

 

[David H. Lipman]

From: "louise" <[email protected]>


| All the tech "knew" was that you shouldn't run two firewalls. He
| seemed to have no concept of NAT etc.
|
| I can ping the site, access it with my browser etc.
|
| Tracert takes 27 hops and it eventually lands at
| http://home.euroweb.sk/ and I gather the updates are at this site.
|
| The last exchange I had with eset tech support led to a copy of the
| tech's own log files in which Nod32 also tried to update many times
| before it succeeded. The tech attributed this to his wireless
| internet conection, but I suspect differently.
|
| I guess I'll keep watch on it and make sure it always does succeed
| in updating.
|
| Louise

Another possibility is an overly budoned update site that can only handles so many
connections and thus a delay in you getting a connection to get the needed updates.

 

[someone]

There can be connection problems to a site for updates. I have seen it at
times with Eset and other sites that do updates. As long as it connects at
some point to the server and does it, it's OK.

Duane

I've been using NOD for about five years with dialup, never had a problem.
Two nights ago there was an unexpected NOD program component upgrade of
about 1.2 Mb, not just the small virus sig updates, maybe that could be what
could have caused the clag, if everybody was uploading that.

I understand that if you run two AV progs simultaneously you could get a
clash, maybe it's the same with a firewall and an AV prog.

s.

 

[Br0wnbear]

I just started using Nod32 in August.

The event logs say Update - trouble reaching server and they say
this every hour or two on most days.

Eventually, after several entries like this, with many different
servers tried, I get a a kernal update and everything is fine....

Here is an example of the logs:

Eset tech support has not been helpful. They say I shouldn't run a
Linksys NAT router and Sygate - in other words, only one
firewall...

But more importantly, they suggest it's a firewall setting problem
router and they don't support anything but their own software -
regardless of whether it plays well with others or not.

I've checked and Sygate is definitely letting the nod kernal
through and is set accordingly.

Help?

Louise

Louise

Why are you running updates every hour?
ESET normally updates their definitions daily. They will run emergency
updates as required. You could change the time of your update to every 6
hours. Every hour seems to be a bit overkill.

I have to agree with David on the fire wall, I am running all three at
home. I also have NOD running on my network at work and haven't run into
these problems, but I don't run Sygate at work.

Brownbear

 

[louise]

Louise

Why are you running updates every hour?
ESET normally updates their definitions daily. They will run emergency
updates as required. You could change the time of your update to every 6
hours. Every hour seems to be a bit overkill.

I have to agree with David on the fire wall, I am running all three at
home. I also have NOD running on my network at work and haven't run into
these problems, but I don't run Sygate at work.

Brownbear

I'm not running updates every hour by choice. What happens
apparently is that when the update effort fails, it retries and
retries.

On the days where the server is reached, there is one update and no
more efforts.

For the last two days it's been fine. I wonder if they did have a
broken or over-burdened server and the tech didn't even know it,
or, they knew it and weren't acknowledging it.

In either case, last two days have been fine and we'll see what
happens from here.

Thanks to everyone for your help.

Louise