Errors in Trend Smart Protection Relay Log

Usage and Config Security
1

(imported topic written by joe5322)

I’m seeing repeated errors in the apricot log in the \Program Files\SPRelay\Smart Protection Relay

The errors look like this:

02-28-13 15:34:27,815

1340

ERROR debug_log -

.\AR_HandlerImpl.cpp:1018

Apricot::ApricotRuleHandler::uplink_failed

Query failed(http query failed). request_uri=/T/2816/UNy3twPUZohGhcG3gTZSpYPSELSO-eR5-cxBPHWxo-SP-, error_code=10

02-28-13 15:34:27,846

1340

ERROR debug_log -

.\AR_HandlerImpl.cpp:1018

Apricot::ApricotRuleHandler::uplink_failed

Query failed(http query failed). request_uri=/T/2816/UNy3twPUZohGhcG3gTZSpYPSELSO-eR5-cxBPHWxb0, error_code=10

The request uri path is actually much longer but I cut it down to make it easier to read. Everytime the log reaches 2 mb in size it creates a new log, keeping the last 5 logs. A new log is being created about every two hours. Everything seems to be working fine. Any ideas what could be causing the problem?

2

(imported comment written by SystemAdmin)

I have the same errors reappearing in my logs as well. Trend didn’t seem to think there was an issue with that.

3

(imported comment written by SystemAdmin)

What kind of setup are you running? Do you have your own Smart Protection Server?

Do you have a hierarchy of relays? If so how many levels?

4

(imported comment written by joe5322)

I have a standalone smart protection server (from a previous version of trend, but it is configured in TEM), a control server, and two relay servers. Both of the relay servers are running as smart protection relays

5

(imported comment written by SystemAdmin)

You can try some of these tests against your relays and sps server. For me I was only able to hit my SPR for WRS and FRS on port 5274. On the SPS server I was able to hit 80, 443, and 5274.

You can use the UPTEST Tool to test File Reputation or Web Reputation links. It can be found in the extProc folder of SPR installation path.

TEST THE FILE REPUTATION LINK:

uptest -fv http://server.ip.or.hostname:port

For example:

To test the localhost SPR service:

uptest -fv http://127.0.0.1:5274

To test the remote SPR service:

uptest -fv http://spr-server:5274

To test SPS:

uptest -fv http://sps-server:80

To test SPN:

uptest -fv http://spn-server:80

TEST THE WEB REPUTATION LINK:

uptest -wv http://server.ip.or.hostname:port

For example:

To test SPS:

uptest -wv http://sps-server:5274

TEST THE WEB REPUTATION LINK:

uptest –wvd http://server.ip.or.hostname:5274

6

(imported comment written by SystemAdmin)

Have to tried creating a entry for a blocked page such as test.com or something and checking that it’s being blocked on your desktop?

7

(imported comment written by SystemAdmin)

Also did you run the task to apply the smart protection server settings to both of your smart protection relays?

8

(imported comment written by joe5322)

We had a smart protection relay server that was having problems passing requests to the smart protection server. It made browsing very slow on client PC’s. After reinstalling the SPR fixlet and rebooting the problem went away. WRS and FRS seem to be working fine but I’m still seeing the errors mentioned in my first post. I don’t know if they indicate a problem or not. I’ve had a support call open with Trend for almost a week and they are not sure what to tell me.

9

(imported comment written by SystemAdmin)

Did you get any more information from Trend about this?

10

(imported comment written by joe5322)

They got back to me today. Here is what they said.

“According to our Product Specialist, the error codes in the SPR access.log and apricot.log are insignificant if the apricot_status.ini shows apricot_status “0”, which means SPR is running without problems.They recommend to use the “Protection Status” CPM Dashboard to see the overall and actual status of the SPR within TEM environment.”