{"id":4239,"date":"2026-06-08T17:58:02","date_gmt":"2026-06-08T14:58:02","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4239"},"modified":"2026-06-08T17:58:02","modified_gmt":"2026-06-08T14:58:02","slug":"how-to-troubleshoot-security-cloud","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fr\/support-articles\/how-to-troubleshoot-security-cloud\/","title":{"rendered":"How to troubleshoot Security Cloud?"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>How to troubleshoot Security Cloud connectivity issues.\u00a0<\/p>\n<p>This article applies to the following products:<\/p>\n<ul>\n<li>Elements EPP for Computers<\/li>\n<li>Elements EPP for Servers\u00a0<\/li>\n<li>Business Suite Client Security\u00a0<\/li>\n<li>Business Suite Server Security<\/li>\n<\/ul>\n<h3>Resolution:<\/h3>\n<div><b>What is Security Cloud?<\/b><br \/>When Security Cloud is enabled on WithSecure endpoint products, it connects to WithSecure Backend to check reputation and other objects. WithSecure endpoint products have database updates which can detect the malware without connection to cloud, but, to check the reputation we need cloud connection. There is the local cache, but it comes first from the cloud, where the whitelisting of false positives is done.<\/div>\n<ul><\/ul>\n<div>Disabling Security Cloud is not recommended as there are many features that are dependent from Security Cloud, like:<\/div>\n<ul>\n<li>DeepGuard with cloud connection:<\/li>\n<\/ul>\n<div style=\"margin-left: 80px;\">Unsigned processes reported as trusted by ORSP will be\u00a0excluded from deep monitoring by DeepGuard<\/div>\n<ul>\n<li>DeepGuard with no cloud connection:<\/li>\n<\/ul>\n<div style=\"margin-left: 80px;\">\u00a0Big performance loses in operations of 3rd party applications<br \/>\u00a0Unsigned files will not be excluded<\/div>\n<ul>\n<li>Application control with cloud connection:<\/li>\n<\/ul>\n<div style=\"margin-left: 80px;\">Rules depending on prevalence rating and reputation will be working fine<\/div>\n<ul>\n<li>Application control with no cloud connection:<\/li>\n<\/ul>\n<div style=\"margin-left: 80px;\">Unsigned files reported as trusted by ORSP will be excluded from scanning by local engines<br \/>Rules depending on prevalence and reputation will not work<br \/>Feature is partially not operational\u00a0<\/div>\n<ul>\n<li>File scanning with cloud connection:<\/li>\n<\/ul>\n<div style=\"margin-left: 80px;\">Unsigned files reported as trusted by ORSP will be excluded from scanning by local engine<\/div>\n<ul>\n<li>File scanning with no cloud connection:<\/li>\n<\/ul>\n<div style=\"margin-left: 80px;\">Unsigned files will not be excluded<br \/>Some performance loses on file access<\/div>\n<ul>\n<li>Browsing protection with cloud connection:<\/li>\n<\/ul>\n<div style=\"margin-left: 80px;\">Works without restrictions<\/div>\n<ul>\n<li>Browsing protection with cloud connection:<\/li>\n<\/ul>\n<div style=\"margin-left: 80px;\">Will not work at all as features fully depend on Security Cloud<br \/>Feature is partially not operational\u00a0<\/div>\n<ul>\n<li>Web Traffic Scanning with cloud connection:<\/li>\n<\/ul>\n<div style=\"margin-left: 80px;\">For URLs reported as trusted and prevalent by ORSP content returned by the server will be scanning<\/div>\n<ul>\n<li>Web Traffic Scanning with no cloud connection:<\/li>\n<\/ul>\n<div style=\"margin-left: 80px;\">WTS will scan all responses of all URLs intercepted causing big performance issues<br \/>Big performance issues on web browsing<\/div>\n<div><b>How does WithSecure Security cloud work?<\/b><br \/>The Security Cloud collects information about unknown applications and websites, malicious applications and malicious activities that exploit the information of users of websites. When you subscribe to Security Cloud, we collect important information so that we can provide you with the security services you subscribe to and enhance the security of our other services. For this reason, and for the operation of our services, we need to collect security information about unknown files, suspicious device activity or visited URLs.<\/p>\n<p>Security Cloud does not monitor your Internet usage and does not collect information about websites that have already been analyzed or about unsafe applications installed on your computer.<\/p>\n<p><b>How do I troubleshoot connectivity issues related to Security cloud?<\/b><br \/>When you enable Security Cloud, you also need to whitelist the following domains on your Firewall, as the endpoints need to communicate to Security Cloud.<\/div>\n<ul>\n<li>*.f-secure.com<\/li>\n<li>*.fsapi.com<\/li>\n<\/ul>\n<div><b>Note: <\/b>The domains mentioned above needs to be whitelisted to your firewall or proxy. In case your have enabled some proxy in your environment, the client reads it\u00a0via discovery service and tries to connect to\u00a0*.fsapi.com\u00a0through it.\u00a0<\/p>\n<p>Client writes that information in\u00a0registry:\u00a0<\/p>\n<p><i>[HKEY_LOCAL_MACHINE\\SOFTWARE\\F-Secure\\Ultralight\\Settings\\proxy]\u00a0<br \/>&quot;value&quot;=(REG_SZ):http:\/\/proxy.example.intern:3128<br \/>&quot;access&quot;=(REG_DWORD):1<\/i><br \/>\u00a0<\/div>\n<div>Example when network queries fail to connect to F-Secure back-end, from fsscorplug.log you will see how the client tries to connect to one of our backend servers and fails:<\/p>\n<p><i>2021-11-12 17:40:30.152 [15c0.1d1c] .W: CurlQuery::completeWithStatus: failure on handle 0000023C45E27C50 5 Could not resolve proxy: proxy.example.intern<br \/>2021-11-12 17:40:30.152 [15c0.1d1c] .W: fs::xrssdk::HTTPQueryTask::update_http_stats: http error 111 (5) for http task 0000023C45E9AC20, time 4 ms<br \/>2021-11-12 17:40:30.152 [15c0.1d1c] .W: ipc_impl::on_async_complete_ex: winrpc call completed err 111<br \/>2021-11-12 17:40:31.751 [15c0.1d1c] \u00a0I: fs::xrssdk::DoormanCache::update: doorman cooldown is off, ttl: 15, fserr: 0<br \/>2021-11-12 17:43:02.424 [15c0.1d1c] .W: CurlQuery::completeWithStatus: failure on handle 0000023C468C1D90 28 Operation timed out after 1006 milliseconds with 0 bytes received<br \/>2021-11-12 17:43:02.424 [15c0.1d1c] .W: fs::xrssdk::HTTPQueryTask::update_http_stats: http error 201 (28) for http task 0000023C45E76790, time 1006 ms<br \/>2021-11-12 17:43:02.424 [15c0.1d1c] .W: ipc_impl::on_async_complete_ex: winrpc call completed err 201<br \/>2021-11-12 17:48:02.964 [15c0.1fe8] \u00a0I: ipc_impl::stopRpcServer: MSRPC Server stopped<\/i><\/p>\n<p>The log can contain fserr 101 or 218 which are actual\u00a0network failures.\u00a0<\/p>\n<p>The log shows some results from\u00a0cache, as the queries are stored for 2 hours in cache, meaning if you just allowed our domains in firewall, client will still use cache queries for another 2 hours. Cache cleanup is for faster results to test the connectivity.\u00a0you can clean the cache directly from client as follows:<\/p><\/div>\n<ol>\n<li>Open a Command prompt with administrator priviledges<\/li>\n<li>Stop the network hoster: <b>net stop<\/b> <b>fsulnethoster<\/b><\/li>\n<li>Remove all files from &quot;C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\F-Secure\\fsscor&quot;<\/li>\n<li>Start network hoster: <b>net start &quot;fsulnethoster<\/b><\/li>\n<\/ol>\n<div>If you have allowed *.f-secure.com and *.fsapi.com in your firewall, you can test the connection in two ways:<\/div>\n<ul>\n<li>Opening the URLs on Browser and they should respond with ok<\/li>\n<\/ul>\n<div style=\"margin-left: 40px;\">https:\/\/baseguard.doorman.fsapi.com\/doorman\/v1\/healthcheck<br \/>https:\/\/doorman.sc.fsapi.com\/doorman\/v1\/healthcheck<br \/>https:\/\/a.karma.sc2.fsapi.com\/healthcheck<\/div>\n<ul>\n<li>Use WithSecure Connectivity Tool, which is available in the installation folders of Elements Endpoint Protection (EPP for Computers and EPP for Servers), Business Client Security and Business Suite Server Security. With the tool you can view the list of addresses the product connects to and check the\u00a0connectivity\u00a0towards them.<\/li>\n<\/ul>\n<p><b>Note:<\/b> For Client Security the tool is available in 15.20 and later versions, and for Server Security 15.10 and later.\u00a0<\/p>\n<p>The tool is located in the following folder:<\/p>\n<ul>\n<li>Client Security: C:\\Program Files (x86)\\F-Secure\\Client Security\\ui\\fsconnectionchecker.exe<\/li>\n<li>Server Security: C:\\Program Files (x86)\\F-Secure\\Server Security\\ui\\fsconnectionchecker.exe<\/li>\n<li>Elements EPP for Computers and EPP for Servers: C:\\Program Files (x86)\\F-Secure\\PSB\\ui\\fsconnectionchecker.exe<\/li>\n<\/ul>\n<p>\u00a0For older Client Security and Server Security releases, you can download the tool from here: <a href=\"https:\/\/download.sp.f-secure.com\/connectivitytool\/ConnectionChecker.exe\" target=\"_blank\" rel=\"noopener\">https:\/\/download.sp.f-secure.com\/connectivitytool\/ConnectionChecker.exe<\/a><\/p>\n<p>What logs do should be checked in case of such behaviour?<\/p>\n<p><b>fsscorplug.log<\/b><br \/>.W: fs::rs::WinSocket::Impl::waitForConnection: Wait failed: 258<br \/>.W: fs::rs::WinSocket::Impl::connect: Conection timeout: doorman.sc.fsapi.com<\/p>\n<p><b>CcfPluginState.log<\/b><br \/>.W: Filter2::ContentFilter2State::ReplyDriverMessage: Failed to reply message 2222<\/p>\n<p><b>orspplug.log<\/b><br \/>.W: fs::rs::WinSocket::Impl::waitForConnection: Wait failed: 258<br \/>.W: fs::rs::WinSocket::Impl::connect: Conection timeout: doorman.sc.fsapi.com<\/p>\n<p><b>DeepGuard.log<\/b><br \/>.W: SecurityCloud::Query: ORSP failed for 0dac68816ae7c09efc24d11c27c3274dfd147dee (0, 0)<br \/>.W: SecurityCloud::Query: Too many successive ORSP failures. Further failure logs will be suppressed<br \/>.W: SecurityCloud::Query: ORSP query took 3016ms<\/p>\n<p><b>transportAgent.log (Email and Server Security only)<\/b><br \/>.W: FSecure.Ess.Fsscore.Client: FSSCORE query for URL(&#39;http:\/\/schemas.microsoft.com\/office\/2004\/12\/xxxx&#39;) Failed, error=Timeout\u00a0<br \/>.W: FSecure.AntiVirus.Exchange.Transport.FSMessageScanner: Can&#39;t get a response from FSSCORE. The following URLs will not be scanned\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>How to troubleshoot Security Cloud?<\/p>\n","protected":false},"template":"","support_article_product":[104],"class_list":["post-4239","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000011711","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 14:58:02","import_hash":"02783259039d97f6ce8681fb0fcdb5c7b37667c0","vanilla_article_id":29354,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/29354-how-to-troubleshoot-security-cloud","vanilla_kb_id":30,"vanilla_category_id":106,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article\/4239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/media?parent=4239"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/support_article_product?post=4239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}