The message “Error occurred in using ActiveUpdate: return code 58” appears in IWSVA.
The error occurs when the update process fails to write the latest pattern received from automatic update, also known as ActiveUpdate, because of insufficient space in the /var partition of IWSVA. This is an indication that the database will soon fail due to lack of space, and this is fatal to IWSVA.
Disk space becomes insufficient when the virtual appliance is undersized or overused. For more information on proper sizing, refer to the IWSVA sizing guide.
Because it is a disk space issue on the partition where the Info_*.tgz is created, any attempt at collecting logs or Network Packet Capture will fail and consume more disk space.
To resolve the issue, determine where most space is consumed:
- Log in to IWSVA as root via SSH.
- Run this command to generate the file summarizing disk usage:
df -h > /tmp/vol.txt ; du -h /var > /tmp/vol.txt
- Open the file using this command:
- Search for the folders taking the most space in /var and /var/iwss.
- Create a snapshot of the VM if you are using VMware.
- From the IWSVA Linux shell, run the following:
cd /var/iwss/actupdate ; rm -rf * ; cd -
- On the web console, update all patterns manually.
- When the patterns have been updated, reboot IWSVA using “init 6”.
- Verify if the issue still occurs, and then do the following:
- If the issue was resolved, delete the snapshot.
- If /var/spool/squid lacks free space, disable content caching by going to HTTP > Configuration > Content Cache on the IWSVA web console. Once you have recovered enough space, make sure you have the latest patch/update/service pack available in the Trend Micro Download Center.
- If pgdata or other directories are causing the issue, submit the vol.txt file to Trend Micro Technical Support.
- If the issue still occurs, revert to the snapshot and contact Trend Micro Technical Support. Submit the vol.txt file.