Content Analysis is unable to update Virus definition even after successfully downloading the definition file

Products

• ProxySG Software - SGOS
• Advanced Secure Gateway Software - ASG
• ISG Content Analysis
• Content Analysis Software

Issue/Introduction

Sometimes the Content Analysis System is not able to apply successfully downloaded a virus definition file. Force pattern update does not solve the problem. System still shows 200 OK. 

Resolution

Table of Contents

• Download status for AV shows 200 OK
• Download Status shows 403
• Download Status shows 500

Download status for AV shows 200 OK

Download status shows 200 OK when AV engine freeze. 

1. Log in to CAS / ASG.
2. Go to Access Utilities -Services -> Refresh Engine and Signatures (For ASG Restart ICAP service).
   
3. Go to the AV Pattern tab and Force pattern download.
   

Download Status shows 403

403 appear when CAS has no access to internet to download data base. Take a pcap and check if a ProxySG or upstream device does not block the access.

1. Go to Access Utilities -> Packet Capture  (For ASG start a PCAP on ProxySG)

Download Status shows 500

This error appears when device is unable to authenticate. 

1. Check the Appliance Certificate or renew it: The Content Analysis System (CAS) does not have a valid birth certificate
2. For Symantec AV check the live update in Services -> AV Scanning Behavior - It should be empty.