Hi,

A few clients are not up to date despite GUP being updated. 

Eg:

A group with 10 PC's,  6 are able to take update from GUP the remaining 4 are unable to take update from GUP even after clearing the corrupt definition and updating it with the latest definition.

Troubleshooting done:

1. Checked whether client is communicating with SEPM - YES

2. Checked whether GUP is "true" for the group = YES gup is "TRUE"

3. Ran sylink monitor SEP is not communicating with SEPM its only communicating with GUP

4. Client might hav corrupt definition - Cleared corrupt definition and updated latest definitions

Environment:

Server OS : Windows 2003 Std

SEPM : 12.1.3

SEP :12.1.2 & 11.0.xx

Even after clearing corrupted definitions its not udpating itself, This issue is not just with one group of clients but with my entire network. 

What do i do to fix this issue?

Check mithun comments follow this steps

https://www-secure.symantec.com/connect/forums/gup-not-updating-clients-0#comment-8508121

Hello,

Troubleshooting the Group Update Provider (GUP) in Symantec Endpoint Protection (SEP)

http://www.symantec.com/docs/TECH104539

Group Update Provider(GUP): Sizing and Scaling Guidelines

http://www.symantec.com/business/support/index?page=content&id=TECH95353&locale=en_US

SEP Content Distribution Monitor / GUP monitoring tool

http://www.symantec.com/business/support/index?page=content&id=TECH156558

http://www.symantec.com/business/support/index?pag...

http://www.symantec.com/business/support/index?pag...

Kindly check the coneectivity beween GUP and respective clients. I would recommend you to follow the basic troubleshootings provided above.

Hi Guys,

Sorry forgot to mention, only a few client in the group wont get update from the GUP the remaining are able to get update from GUP.

can you post the sylink log

Hi,

Will upload it in a while.

Hi

Can you check whether the port 2967 is opened bi-directionally

Regards

A simple check that is often overlooked is to make sure the clients have enough disk space to process the updates.  This has bitten me in the past.

Hi

Can you please update on the status

Regards

Hi,

For security reasons i have renamed the Ip address to "ip", please find the sylink monitor attached.

The status now is both my GUP clients are updated and non of the clients are updated

Attachment(s)

SylinkMonitor.txt   108 KB 1 version

Hi,

I checked the logs and found 

Error : 10/09 19:20:51.845 [1768] <mfn_DoGetIndexFile200>Signature verification FAILED for Index File Content.. 

Followed http://www.symantec.com/docs/TECH102900

are these 64 bit machines?

Hi Rafeeq,

32-bit only

Hi Guys,

I am still facing this issue, what can i do?

Hi,

Try to one aur two system clear old virus defination and check

How to clear out corrupted definitions for a Symantec Endpoint Protection client manually

The issue is not wtih the GUP and its definitions.

The sylink.log shows an issue in the communication with the SEPM (yet, required to have the client going to the GUP for updates). Most likely a wrong sylink.xml, replace it on the problematic clients with one from a working client in the same group:

http://www.symantec.com/business/support/index?page=content&id=TECH157585

Let us know if it works.

Just to cover the basics...
Are there other clients in same SEPM group container that are receiving updates? (You said yes)
Was machine restarted? (Unknown)
Did you change default SEPM communication port from TCP 8014 to another port? (Assigned during Initial SEPM setup.) (Unknown)
-Assuming You didn't, From EVERY client, you should be able to access http://<SEPM IP>:8014/content/contentinfo.txt.
 This will list GUIDs in SEPM c:\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\content folder
Did you change default GUP port? (This is set at 'My Company' level in clients, server settings, if inherited, or at each group container.
 If not, you should be able to access http://<GUP IP>:2967/content/contentinfo.txt and get same info as above.
Any recent changes to network or SEPM server?
It seems error lies between Check point 4, and Check point 5.1.
 10/09 18:51:07.159 [4076] <ParseHTTPStatusCode:>468=>468 Request not allowed
 10/09 18:51:31.269 [4076] <GetIndexFileRequest:>Send Request failed.. Error Code = 12029
 10/09 18:51:31.269 [4076] <ParseErrorCode:>12029=>The attempt to connect to the server failed.
 10/09 18:51:31.269 [4076] <GetIndexFileRequest:>Send Request failed.. Error Code = 12029
 10/09 18:51:31.269 [4076] <ParseErrorCode:>12029=>The attempt to connect to the server failed.
~~~~~~~~~~~~~~~~~~~~~
Here's some steps I would do...
Download a new client definition and run on a single client
Check all group container policy settings in SEPM console.
Export new sylink communications file
STOP SMC service on client machine (SMC -stop) (Wait 2 minutes before restarting)
While waiting, rename newly exported sylink communications file to 'sylink.xml'
On client replace \program files\symantec\symantec endpoint protection\sylink.xml with newly export/renamed sylink file]
Start SYLINK Monitor tool.
Start SMC service (SMC -start)

Please post results - Good luck.
 

have you got ur answer?