Endpoint Protection

We are in the process of migrating from SAV 10.1.8.8000 to SEP 11 RU5.  We have a central office connected to ~ 250 remote offices connected via slow WAN links {256K}.  We have set the Heartbeat to 7 hours to try and reduce the traffic during the day when the lines are mostly saturated.   We have two management servers using one SQL server as the database.  We have added 14 clients to this setup. The 14 clients are distributed across two groups.  One group has one gup defined and the the other group has multiple gups defined.  About every 3 or 4 days, 2 or 3 of the 14 clients are not updating thier AV definations and they are a day behind.  If you don't do anything, they will catch up the next day.   Is it normal for nearly 20% of the workstations to be behind on their definations.  When we get the ~15,000 workstations converted, are we normally going to have 3000 workstations a day behind on their definations.  

Every time several of the clients get a day behind, one of the SEP 11 Management servers's client is also a day behind.  Is there any way to tell why they are not getting updated?  The are obvioulsy getting a hearbeat because the SEP 11 Management console shows they are still on line and shows a last connect time withing the 7 hour hearbeat but still the definations are not getting updated.  

Any Ideas?

Bruce Singer
Bruce.A.Singer@oa.mo.gov
State of Missouri - OA - ITSD - DSS  

 

Greetings,

Are the GUP's Windows XP machines? If so that would explain it, Windows XP has a 10 connection limit. If there are already 10 machines connected to the GUP anyone else gets denied and it will wait until its next heartbeat, 7 hours, to try again.

If it is not Windows XP that I am not so sure, would maybe need to enable some logging for one us to review to see if we can tell what's ocurring.

Hi Bruce...

 As John said.. XP has that limitation...

We have a setup of 25000 client with heart beat 1 hour and we are finding difficulty in maintaining 70% updation status everyday. We are not able to conclude 

According to me none of the Antivirus product in the world can achieve 100% updation status for all the clients unless used with other products which will provide alternate updation path.

No, all the GUPS are Window Server 2003

If the SEPM is behind, that would explain why the clients are behind.  What is the LiveUpdate schedule for the SEPMs themselves?  Default is every four hours.

sandra

To reduce bandwidth during the day, we update the SEPM once a day at 5:30 PM.  By experimation, I found out that if I reduced the HeartBeat down from 7 hours to 3 hours, that most of the clients show updated on the SEPM by the next morning at 7:30 am and also show on-line. 

I do not know why it takes the clients ~4 hearbeats to get the SEPM to show updated Anti-Virus definations but it is obious it takes more than 1 hearbeat to get the definations updated and to show updated on the SEPM.

Sincerely
Bruce Singer