The network administrator gets an e-mail notification that the antivirus update failed & "Not Modified (304)"

Products

• Content Analysis Software

Issue/Introduction

The network administrator gets an e-mail notification that the antivirus update failed & "Not Modified (304)"

Resolution

For the momentary AV pattern update failure reported, please refer to the below.

Symptoms: The network administrator gets an e-mail notification that the antivirus update failed.

Cause/Solution 1: It is possible that the DNS server was temporarily down or some other network problem interfered with the virus update. Try forcing the update by selecting Services > AV Patterns and clicking Force Update All Now. 

Cause/Solution 2: Each antivirus vendor, including Kaspersky, provides pattern file updates that necessarily contain portions (or descriptions) of viruses. Generally, these virus segments are encoded and are too small to be mistaken as a true virus by other AV vendors. But occasional false positives occur. These can be prevented by exempting virus pattern update locations from scanning, as the following example policy illustrates (place this policy after all other ICAP policies on the ProxySG):

<cache> url.host=download.bluecoat.com response.icap_service(no) url.host=av-download.bluecoat.com response.icap_service(no)

In your case, the first, above, was the probable cause.

For the second question, concerning the "Not Modified (304)" message, this means that particular CAS AV have the latest pattern already and no download is needed. So its all good. You can check the pattern date to see that.