> Source: [sk180166](https://support.checkpoint.com/results/sk/sk180166)

# sk180166 - Anti-Malware signatures might fail to update starting March 5th 2024 on On-Premises Endpoint Management Server

| Property | Value |
|----------|-------|
| Solution ID | sk180166 |
| Date Created | 2022-10-23 |
| Last Modified | 2024-01-31 |
| Technical Level | Advanced |
| Products | Endpoint Security |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * If you use Harmony Endpoint Cloud Services only (not On-Premises), this artice doesn't apply to you.
* Following a review made by our teams, we noticed a scenario where an internal key in the Anti-Malware signatures update service (installed on the on-premise Endpoint Security Server) may expire on March 5th 2024. This can affect visibility and application of new Anti-Malware signatures updates on the Endpoint Security Server following this date.

* It is important to stress that this does not affect your connectivity or operational routines, but is highly recommended from a security standpoint to ensure you have the best security we believe you deserve.
* This article applies **only if all of the following conditions apply:**

  * On-premises Endpoint Security Servers and Policy Servers R81.20 and lower (Harmony Endpoint Cloud Services are up-to-date).

  * Endpoint Security Servers with the **Anti-Malware engine**.

    <br />

  * Endpoint Security Clients are configured to receive updates from Local Endpoint Server:

    ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk180166/local_sig202401041138271.png)

    Or in SmartEndpoint:

    ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk180166/local202210251255281.png)
* After the internal key expires, the "`Anti-Malware signatures have not been updated in 72 hours`" alert may appear in Web UI/SmartEndpoint on the "Overview" tab (alert by email is also sent, if configured).

## Cause

The signatures update service (Anti-Malware engine) internal key has expired.

This affects only updates of new Anti-Malware signatures. **The Anti-Malware blade continues to work with the current signatures.**

### How to check if your environment should be updated?

1. Connect to the command line on the on-premises Endpoint Security Server.

2. Log in to the Expert mode.

3. Check if this directory exists:

   `stat $UEPMDIR/engine/conf/updates/bin/8.6.0.34`

   What to do next:
   * If there is **no** such directory, then stop - this article does not apply.

     > Example output:
     >
     > ```
     > [Expert@MyMGMT:0]# stat $UEPMDIR/engine/conf/updates/bin/8.6.0.34
     > stat: cannot stat '/opt/CPuepm-R81/engine/conf/updates/bin/8.6.0.34': No such file or directory
     > [Expert@MyMGMT:0]#
     > ```

   * If such a directory **exists**, continue to the next step:

     > Example output:
     >
     > ```
     > [Expert@MyMGMT:0]# stat $UEPMDIR/engine/conf/updates/bin/8.6.0.34
     >   File: '/opt/CPuepm-R81/engine/conf/updates/bin/8.6.0.34'
     >   Size: 72              Blocks: 0          IO Block: 4096   directory
     > Device: fc01h/64513d    Inode: 33554551    Links: 2
     > Access: (2770/drwxrws---)  Uid: (    0/   admin)   Gid: ( 1500/cpep_user)
     > Access: 2021-10-23 20:51:12.020586084 +0300
     > Modify: 2021-08-13 18:09:47.205116367 +0300
     > Change: 2021-10-06 13:20:21.698255138 +0300
     >  Birth: -
     > [Expert@MyMGMT:0]#
     > ```

4. Get the list of the current internal key files:

   `ls $UEPMDIR/engine/conf/updates/bin/8.6.0.34/ | grep key`
   > Example output:
   >
   > ```
   > [Expert@MyMGMT:0]# ls $UEPMDIR/engine/conf/updates/bin/8.6.0.34/ | grep key
   > 57263987.key
   > 57576269.key
   > [Expert@MyMGMT:0]#
   > ```

   What to do next:
   * If there are **2 or more** internal key files:

     Follow **one** of the available Solutions below.
   * If there is only **one** internal key, get the expiration date of this internal key:

     `$UEPMDIR/engine/conf/updates/bin/8.6.0.34/keepup2date8.sh --licinfo --simplelic`

     Example output:
     >
     > ```
     > LICENSE INFO:
     > Key file: 57576269.key
     > Expiration date: 05/03/2024
     > Operation result code: 0x00000000. 0 (Success) 
     > ```

     What to do next:
     * If the returned "Expiration date" shows "**05/03/2024**" (or earlier) - follow one of the available Solutions below.

     * If the returned "Expiration date" shows "**XX/XX/2027**", then stop - this article does not apply, the signature service is up to date.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content