none
Event ID 10032 & 364 on WSUS server RRS feed

  • Question

  • I'm seeing the following errors on our WSUS server:

    Log Name:      Application
    Source:        Windows Server Update Services
    Date:          9/28/2014 5:12:47 AM
    Event ID:      10032
    Task Category: 7
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:     {server.domain.com}
    Description:
    The server is failing to download some updates.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Windows Server Update Services" />
        <EventID Qualifiers="0">10032</EventID>
        <Level>2</Level>
        <Task>7</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-09-28T10:12:47.000Z" />
        <EventRecordID>8069</EventRecordID>
        <Channel>Application</Channel>
        <Computer>{servername}.{domain}.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>The server is failing to download some updates.</Data>
      </EventData>
    </Event>


    Log Name:      Application
    Source:        Windows Server Update Services
    Date:          9/28/2014 3:05:12 AM
    Event ID:      364
    Task Category: 2
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      {server.domain.com}
    Description:
    Content file download failed. Reason: File cert verification failure. Source File: /msdownload/update/software/crup/2012/08/csi-x-none_a67aa308af03c7a5884974abe6fd834591b0f3a3.cab Destination File: c:\WSUS\WsusContent\A3\A67AA308AF03C7A5884974ABE6FD834591B0F3A3.cab.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Windows Server Update Services" />
        <EventID Qualifiers="0">364</EventID>
        <Level>2</Level>
        <Task>2</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2014-09-28T08:05:12.000Z" />
        <EventRecordID>8051</EventRecordID>
        <Channel>Application</Channel>
        <Computer>{ server.domain.com} >
        <Security />
      </System>
      <EventData>
        <Data>Content file download failed. Reason: File cert verification failure. Source File: /msdownload/update/software/crup/2012/08/csi-x-none_a67aa308af03c7a5884974abe6fd834591b0f3a3.cab Destination File: c:\WSUS\WsusContent\A3\A67AA308AF03C7A5884974ABE6FD834591B0F3A3.cab.</Data>
      </EventData>
    </Event>

    I pulled this from the SoftwareDistributionLog:
    2015-02-04 08:06:53.421 UTC Info WsusService.26 CabUtilities.CheckCertificateSignature File cert verification failed for c:\WSUS\WsusContent\A3\A67AA308AF03C7A5884974ABE6FD834591B0F3A3.cab with 2148204801
    2015-02-04 08:06:53.421 UTC Warning WsusService.26 ContentSyncAgent.ProcessBITSNotificationQueue Invalid file deleted: c:\WSUS\WsusContent\A3\A67AA308AF03C7A5884974ABE6FD834591B0F3A3.cab
    2015-02-04 08:06:53.421 UTC Info WsusService.26 ContentSyncAgent.ContentSyncSPFireStateMachineEvent ContentSyncAgent firing Event: FileVerificationFailed for Item: 21d2460c-e9d5-4706-b06e-264477e4f6bb
    2015-02-04 08:06:53.452 UTC Info WsusService.26 EventLogEventReporter.ReportEvent EventId=364,Type=Error,Category=Synchronization,Message=Content file download failed. Reason: File cert verification failure. Source File: /msdownload/update/software/crup/2012/08/csi-x-none_a67aa308af03c7a5884974abe6fd834591b0f3a3.cab Destination File: c:\WSUS\WsusContent\A3\A67AA308AF03C7A5884974ABE6FD834591B0F3A3.cab.
    2015-02-04 08:06:53.546 UTC Info WsusService.26 ContentSyncAgent.WakeUpWorkerThreadProc ContentSyncAgent found no more Jobs, thread exitting
    2015-02-04 08:06:53.546 UTC Info WsusService.26 EventLogEventReporter.ReportEvent EventId=363,Type=Information,Category=Synchronization,Message=Content synchronization succeeded.

    I’ve tried to follow the instructions in this article:
    http://www.winvistatips.com/threads/wsus-keeps-gettign-content-file-download-failed-reason-crc-verification-failure-errors.748027/

    Starting with Step 1, “Mark the update as ‘Not Approved’ on the WSUS Server” – How exactly do I determine which KB this relates to in order to mark it not approved?  I don’t see anything in the log or event viewer that gives me any type of cross reference to find that information.  


    Wednesday, February 4, 2015 4:33 PM

Answers

  • There are certificate related errors in your log file, also the error code 2148204801 (800B0101 in hex) points security certificate issue as well.

    I assume your WSUS is up to date but what about the root certificates on your server?

    What is your OS? Does it automatically update root certificates on your system?

    You can visit http://support.microsoft.com/kb/931125 for Root Cert Update and https://technet.microsoft.com/en-us/library/dn265983.aspx for more details (e.g. Your server should be able resolve and connect ctldl.windowsupdate.com:80 )


    Osman Shener

    Wednesday, February 4, 2015 8:57 PM
  • Content file download failed. Reason: File cert verification failure.

    Typically this result occurs when the WSUS server is missing some root and/or intermediate certificates, most notably those needed to validate digital signatures on files signed by Microsoft.

    http://www.winvistatips.com/threads/wsus-keeps-gettign-content-file-download-failed-reason-crc-verification-failure-errors.748027/

    Kinda intrigued that you're using an article from VistaTips.com to solve a WSUS problem. :-)

    Especially since the error obtained in that VistaTips.com thread has nothing at all to do with the error you're getting.

    Starting with Step 1,

    Not to worry. Those instructions I wrote in that thread back in 2008 were specific to THAT error scenario. They do not apply to you.

    In your case, presumably you would just need to get the missing certificates and install them. Root certificates are normally updated automatically on server operating systems (except Windows Server 2003 which has a known defect), so when this issue arises with respect to Microsoft certificates, almost always the issue is that the Certificate Update capability has been disabled on the server.

    But this issue can also occur when an ancient (expired/superseded) update has been approved, and the digital signature on the file really is out of date and associated with an expired or revoked certificate. If this is a NEW WSUS server installation and you just approved everything that wasn't walking away, then that's probably the root cause of the problem.

    We get a small clue about the actual update, sometimes more (but not in this case) by looking at the SOURCE pathname and filename.

    Source File: /msdownload/update/software/crup/2012/08/csi-x-none_a67aa308af03c7a5884974abe6fd834591b0f3a3.cab

    First observation is that this update dates all the way back to AUGUST 2012.

    Other methodologies to find out what update is affected == enable the FILE STATUS icon in the All Updates view and sort. Find the update(s) that are reporting Failed Downloads. Then use File Information from the context menu to isolate the short list to the specific update that has a filename of A67AA308AF03C7A5884974ABE6FD834591B0F3A3.cab.


    Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
    SolarWinds Head Geek
    Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
    My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
    http://www.solarwinds.com/gotmicrosoft
    The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.

    Wednesday, February 4, 2015 9:01 PM
    Moderator

All replies

  • There are certificate related errors in your log file, also the error code 2148204801 (800B0101 in hex) points security certificate issue as well.

    I assume your WSUS is up to date but what about the root certificates on your server?

    What is your OS? Does it automatically update root certificates on your system?

    You can visit http://support.microsoft.com/kb/931125 for Root Cert Update and https://technet.microsoft.com/en-us/library/dn265983.aspx for more details (e.g. Your server should be able resolve and connect ctldl.windowsupdate.com:80 )


    Osman Shener

    Wednesday, February 4, 2015 8:57 PM
  • Content file download failed. Reason: File cert verification failure.

    Typically this result occurs when the WSUS server is missing some root and/or intermediate certificates, most notably those needed to validate digital signatures on files signed by Microsoft.

    http://www.winvistatips.com/threads/wsus-keeps-gettign-content-file-download-failed-reason-crc-verification-failure-errors.748027/

    Kinda intrigued that you're using an article from VistaTips.com to solve a WSUS problem. :-)

    Especially since the error obtained in that VistaTips.com thread has nothing at all to do with the error you're getting.

    Starting with Step 1,

    Not to worry. Those instructions I wrote in that thread back in 2008 were specific to THAT error scenario. They do not apply to you.

    In your case, presumably you would just need to get the missing certificates and install them. Root certificates are normally updated automatically on server operating systems (except Windows Server 2003 which has a known defect), so when this issue arises with respect to Microsoft certificates, almost always the issue is that the Certificate Update capability has been disabled on the server.

    But this issue can also occur when an ancient (expired/superseded) update has been approved, and the digital signature on the file really is out of date and associated with an expired or revoked certificate. If this is a NEW WSUS server installation and you just approved everything that wasn't walking away, then that's probably the root cause of the problem.

    We get a small clue about the actual update, sometimes more (but not in this case) by looking at the SOURCE pathname and filename.

    Source File: /msdownload/update/software/crup/2012/08/csi-x-none_a67aa308af03c7a5884974abe6fd834591b0f3a3.cab

    First observation is that this update dates all the way back to AUGUST 2012.

    Other methodologies to find out what update is affected == enable the FILE STATUS icon in the All Updates view and sort. Find the update(s) that are reporting Failed Downloads. Then use File Information from the context menu to isolate the short list to the specific update that has a filename of A67AA308AF03C7A5884974ABE6FD834591B0F3A3.cab.


    Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
    SolarWinds Head Geek
    Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
    My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
    http://www.solarwinds.com/gotmicrosoft
    The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.

    Wednesday, February 4, 2015 9:01 PM
    Moderator
  • Thank you for taking the time to respond.  I will take a look at the links you've provided and see what I can find out.  
    Thursday, February 5, 2015 10:40 PM
  • Thank you for the information!  I will try to carve out some time tomorrow to take a look at some of the things you've suggested.  Will advise!
    Thursday, February 5, 2015 10:41 PM