Clients no longer communicate when the IP address for the Symantec AntiVirus Corporate Edition parent server changes

Article:TECH99934  |  Created: 2002-01-18  |  Updated: 2010-08-15  |  Article URL http://www.symantec.com/docs/TECH99934
Article Type
Technical Solution

Product(s)

Environment

Issue



The Symantec AntiVirus Corporate Edition parent server's IP address has changed. The Symantec System Center no longer displays the clients for the server, and clients no longer receive virus definition updates.

 


Solution



When a Symantec AntiVirus parent server's IP address changes, clients may continue to check in using the old IP address. To ensure that the IP address is the problem, see the following sections:

  • Restart the Symantec AntiVirus service.
  • Confirm that clients have the correct IP address for their parent server.
  • Confirm naming resolution.
  • Confirm that the Grc.dat file contains the correct IP address for the parent server.
  • Copy a new Grc.dat file to affected clients.



To restart the Symantec AntiVirus service

  1. On the windows taskbar, click Start > Run.
  2. In the Open box, type the following text:

    services.msc

     
  3. Click OK.
  4. In the right pane, select Symantec AntiVirus Server, and click Stop.
  5. When the service stops, click Start.


 


WARNING: Back up the system registry before you make any changes. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the keys that are specified. Before you proceed, read How to back up the Windows registry.
 




To confirm that the clients have the correct IP address for their parent server

  1. On the client computer, click Start > Run. .
  2. In the Open box, type the following text:

    regedit

     
  3. Click OK.
  4. In the Registry Editor, go to the following key:

    HKEY_LOCAL_MACHINE/Software/Intel/Landesk/VirusProtect6/CurrentVersion/AddressCache/<Parent server name>

    This key has an entry for the Symantec AntiVirus servers that the client connects to, or that exist in the Grc.dat file. Normally, only one computer is listed.
     
  5. Select the <Parent server name> key, and locate the Address_0 value in the right pane.
    The value data should look similar to the following:

    00 04 20 00 0b 97 00 00 9b 40 7b fd 00 00 00 00 00 00 00 00 00
     
  6. Count over to the ninth set (00 being set number 1) and translate the hexadecimal number to decimal (with the Microsoft Scientific calculator). Repeat this process for each of the next 3 hex values.This is the IP address the client has for the parent server. If the IP address is incorrect, please see the directions to copy a new Grc.dat file below.
    In the previous example, your result would be 9b=155 40=64 7b=123 fd=253 for an IP address of 155.64.123.253.
  7. On the Registry menu, click Exit to save the changes and close the Registry Editor.


 


Note: Some of our documentation indicates that registry keys are only used once. This is not correct. Registry keys are constantly updated. However, the Address_0 line of Grc.dat is only updated when the Symantec AntiVirus service starts. This means that you need to stop and restart the Symantec AntiVirus service for the Address_0 to update. For more information, see the section "To confirm that the Grc.dat file contains the correct IP address for the parent server" below.
 



The computer name is a vital part of how Symantec AntiVirus works. Symantec AntiVirus is monitoring for computer name changes and will update when a name is changed.

For a list of ports used by Symantec AntiVirus, read the document for your program version:


To confirm naming resolution

  1. Open a command prompt on the client.
  2. Ping the parent by name.
  3. Open a command prompt on the parent server.
  4. Ping the client by name.


To confirm that the Grc.dat file contains the correct IP address for the parent server

  1. Use a text editor, such as Notepad to open the Grc.dat file on the parent server.
    Grc.dat is in the directory where Symantec AntiVirus is installed; by default the location is \Program Files\SAV or \Program Files\Symantec AntiVirus.
  2. Locate the line that begins with Address_0.The entire line looks similar to the following:

    Address_0=B0020000420000B9700009B407BFD0000000000000000000000000000000000000000
  3. Count over to the 22nd and 23rd digits, and translate the hexadecimal number to decimal (with the Microsoft Scientific calculator).
    Repeat this process for each of the next three pairs of hex values.This is the IP address the Grc.dat has for the parent server. If the IP address is incorrect, restart the Symantec AntiVirus Server service to generate an updated Grc.dat file.
    In the previous example, your result would be 9b=155 40=64 7b=123 fd=253 for an IP address of 155.64.123.253.


Once you have verified that the Grc.dat contains the correct IP address, move on to the next section.

To copy a new Grc.dat file to affected clients

  1. Copy a new Grc.dat file from the parent server.
    To learn how to do this, read the document for your program version:
  2. Run a Discovery in Symantec System Center:
    1. Click Tools > Discovery Service.
    2. Click Run Discovery Now.





 



Legacy ID



2002091816421448


Article URL http://www.symantec.com/docs/TECH99934


Terms of use for this information are found in Legal Notices