topic Re: MacOSX Big Sur TimeMachine failures with Endpoint E84.30.0820 (with Sandblast Agent). in Endpoint

MacOSX Big Sur TimeMachine failures with Endpoint E84.30.0820 (with Sandblast Agent).

0b708c5a-0dae-3 — Thu, 11 Feb 2021 19:37:32 GMT

I am unable to complete a TimeMachine backup to a Time Capsule, since I installed the Endpoint E84.30 Sandblast client on my MacBook. Prior to this, I had just the VPN client on the MacBook and it worked fine. After the installation, it said I had to create a new TimeMachine backup, which I did (by disconnecting from the Time Capsule and reconnecting with the erase old backups option). The backups start and then fails with no errors other than the ones in the system log:

Feb 11 11:00:16 ren backupd[1212]: DEPRECATED USE in libdispatch client: dispatch source activated with no event handler set; set a breakpoint on _dispatch_bug_deprecated to debug
Feb 11 11:01:29 localhost backupd[225]: DEPRECATED USE in libdispatch client: dispatch source activated with no event handler set; set a breakpoint on _dispatch_bug_deprecated to debug
Feb 11 11:10:17 ren com.apple.xpc.launchd[1] (com.apple.backupd[225]): Service exited with abnormal code: 89

I have tried reformatting my TimeCapsule, but the failures persist. Other desktops without Sandblast installed continue to work on the same TimeCapsule. It seems to be linked to whether or not a USB flash drive is inserted.

I could not find any "Known issues" related to this or any posts. Is anyone aware of any issues with TimeCapsule backups and Sandblast?

Some quick additional information...

MacBook is running:

MacOSX 11.2.1 (encrypted via Apple FileVault)
Blades installed: Remote Access VPN, Compliance, Media Encryption, Capsule Docs, Forensics and Andi-ransomware, and Anti-malware.
Capsule Docs is not enabled (not configured)

Re: MacOSX Big Sur TimeMachine failures with Endpoint E84.30.0820 (with Sandblast Agent).

0b708c5a-0dae-3 — Fri, 12 Feb 2021 19:40:21 GMT

I was able to find the following sk110975 (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110975). It is a really old ticket, but lists the current EndPoint client release in it.

It says that TimeMachine to external backups is not supported. It also says "Media Encryption blade: Media scan - not supported", but I saw that work when I inserted my USB device. There is no update timestamp that I could find on the ticket, so I am not sure if it is up-to-date. If anyone got Time Machine external backups to work, please let me know how?

Re: MacOSX Big Sur TimeMachine failures with Endpoint E84.30.0820 (with Sandblast Agent).

G_W_Albrecht — Fri, 12 Feb 2021 20:24:11 GMT

First i would try to disable the Media Encryption blade.

Re: MacOSX Big Sur TimeMachine failures with Endpoint E84.30.0820 (with Sandblast Agent).

0b708c5a-0dae-3 — Fri, 12 Feb 2021 20:39:58 GMT

Yeah, I removed all the blades from the install bundle except for Anti-malware and the VPN client. I confirmed that no other blades were listed in the Overview, and the backup still failed.

I thought I could maybe configure the Anti-malware to ignore the 'backupd' process, but sk110975 says that will not work as well. It says the MD5 exclusion is not valid for MacOSX and the certificate exclusion only allows EXE and DLL files.

Re: MacOSX Big Sur TimeMachine failures with Endpoint E84.30.0820 (with Sandblast Agent).

G_W_Albrecht — Mon, 15 Feb 2021 10:50:07 GMT

I would contact TAC - sk110975 is talking about the Media Encryption blade, not about AM...

Re: MacOSX Big Sur TimeMachine failures with Endpoint E84.30.0820 (with Sandblast Agent).

0b708c5a-0dae-3 — Fri, 19 Feb 2021 20:27:35 GMT

In case anyone else finds this helpful, I had to add a bunch of exclusions in the Anti-Malware and the Anti-Ransomware rules:

/usr/libexec/syspolicyd

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mds_stores

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService

/Volumes/.timemachine/*

/System/Volumes/Data/.Spotlight-V100/*

/System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd

/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker

/System/Volumes/Data/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker

The Anti-Ransomware is popping up and empty window during the backup saying no files were affected, but the backups are now finishing. Checkpoint is still addressing the pop-up window.

Re: MacOSX Big Sur TimeMachine failures with Endpoint E84.30.0820 (with Sandblast Agent).

Ted_Serreyn — Wed, 03 Mar 2021 15:56:51 GMT

I will be testing this today, and will let you know my results. Been having this problem with a brand new laptop.