Video Screencast Help

Download liveupdates on SEPM 12.X but aren't shown on 'Show LiveUpdate Downloads'

Created: 28 Jan 2013 • Updated: 17 Feb 2013 | 20 comments
haroldvm89's picture
This issue has been solved. See solution.

Hello everyone!

I'm implementing SEP servers. I've done a bunch of installations before, but now I'm having a hard time with one server especially

The situation:

Installed SEPM a while ago, lets say back on second week of January. Then, it downloaded the first liveupdate on January 16th

The problem:

Looks like, i'm not sure about this, liveupdate content are downloaded but i cant see them at the 'Show LiveUpdate Download'. I keep hitting 'Download Liveupdate content' but all i can see is liveupdate content from January 16th

This is the log i see whenever I clic  'Download Liveupdate content'

Yes, I get the 'return code = 1' problem. I have try everything to solve:

# Uninstall LiveUpdate, delete all folders related and reinstalling LiveUpdate

# Stop SEPM services, delete LiveUpdate folders (where content update is stored) and reinstalling LiveUpdate

# Run commands lucatalog.exe -cleanup and lucatalog.exe -update

I came to use every solution i found on this forum

 

However, my guess is that LiveUpdate content is actually downloaded because in folders (where content update is stored) i see the liveupdate content up to date (January 28th)

 

Here i can see liveupdate content up to date

So how is it possible that this folders contain information (from LiveUpdate server) updated but the definitions i see on SEPM log are from back January 16th. Im confused :(

 

I'm gonna uninstall SPEM and install all over again. Lets hope it works.

Does anybody have this problem before? I came with no solution and i really need one.

 

Thanks for the help in advance

 

 

 

 

 

Comments 20 CommentsJump to latest comment

Ashish-Sharma's picture

hi,

Are you using proxy ?

Check attached thread all port open or not

https://www-secure.symantec.com/connect/forums/sym...

Do you have check this artical

 

"There were no new content updates. Return code = 1" Definitions are not up to date on the Symantec Endpoint Protection Manager

Article:TECH95830  |  Created: 2009-01-28  |  Updated: 2011-09-28  |  Article URL http://www.symantec.com/docs/TECH95830
 

 

Thanks In Advance

Ashish Sharma

 

 

.Brian's picture

What was the date of the content showing on the Home tab?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

haroldvm89's picture

Here's the pic from today (January 29th)

 

 

I'm still not able to see download content up to date!!! :(

Ambesh_444's picture

Please remove all old definition from sepm console and then reboot the server,

After that run live update on server and even check that on sepm server latest live update installed or not if not then install it first and then run luall.

 

Thank& Regards,

Ambesh

"Your satisfaction is very important to us. If you find above information helpful or it has resolved your issue. Please don't forget to mark the thread as solved."

Ajit Jha's picture

Hi,

You can try this Workaround:

- remove LiveUpdate
- reboot server
- Delete C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate & C:\Program Files\Common Files\Symantec Shared\SymcData folders
- resintall LiveUpdate from CD1\SEPM\LUSETUP.EXE
- run lucatalog -cleanup
- run lucatalog -update
- manual liveupdate from SEPM Console
May need to repeat these step a second time for the problem to be resolved.

Regard's

Ajit Jha

Technical Consultant

ASC & STS

haroldvm89's picture

I did everything step by step but didn't work

I delete all content updates [from those folders] but all i can see in SEPM is definitions from January 16th

Thanks anyway

 

SebastianZ's picture

* Can you check directly in the definitions folder:

C:\Program files (x86)\Symantec Endpoint Protection Manager\Inetpub\content\535CB6A4-441F-4e8a-A897-804CD859100E

C:\Program files (x86)\Symantec Endpoint Protection Manager\Inetpub\content\07B590B3-9282-482f-BBAA-6D515D385869

...what is the latest subfolder under that. The fact that the modyfication date of the main folder changed does not mean necessary it has the latest content - look here for subfolder with definition name and revision in name -> then check as well inside if you see a full.zip file and a FULL subfolder.

 

* as for the Liveupdate reinstallation please use during that the "lucatalog -forcedupdate" command and not the (-update command) as the former was from SEP 11.x

 

Mithun Sanghavi's picture

Hello,

What version of SEP 12.1 are you running?

Make sure you are running the Latest verison of SEP 12.1 RU2. If not, please migrate to the Latest version of SEP 12.1 RU2.

If it is already SEPM 12.1 RU2, then please upload us the Log.liveupdate to check the root cause of the issue.

What happens if you run the luall.exe from Start >> Run??

If the download happens after running the Luall.exe, then you may need to re-register Liveupdate with SEPM by following the steps provided in the Article below:

http://www.symantec.com/docs/TECH171060

Also make sure you are running the correct version of Liveupdate for your SEPM, check this Article:

http://www.symantec.com/docs/TECH181305

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

haroldvm89's picture

Thanks for everyone who posted here!

I checked everything you said in this posts above but it didn't work. I'm still stuck with this problem.

I deleted updates content from all folders where downloads are stored, I downloaded new content again but all i can see in SEPM is definitions from January 16th.

I feel like these old definitions SEPM got stuck in 'Show LiveUpdate Content' section

Attached log.liveupdate. Really hope someone can help me, here!

Thanks in advance

 

AttachmentSize
Log.LiveUpdate.txt 1.45 MB
Félix_RS's picture

haroldvm89, I'm going through the same problem. My SEMP began presenting this issue on january 28. I opened a call at symantec support and help of all possible solutions suggested in this forum. Also removed the registry settings and repair the installation of SEPM. Rebooted the server and the problem continues. My call was escalated to the advanced support of symantec.

If any of you have any other solution thanks.

Ashish-Sharma's picture

HI,

 

29/01/2013, 23:45:41 GMT -> EVENT - SESSION END SUCCESSFUL EVENT - The LiveUpdate session ran in Silent Mode. LiveUpdate found 0 updates available, of which 0 were installed and 0 failed to install.  The LiveUpdate session exited with a return code of 100, LiveUpdate se ejecut� correctamente. No hay actualizaciones de sus productos.

Check this artical

http://www.symantec.com/business/support/index?pag...

Check this Thread also and MICK2009 Comments

https://www-secure.symantec.com/connect/forums/iss...

 

 

Thanks In Advance

Ashish Sharma

 

 

Ambesh_444's picture

Hello Please check that your SEPM server drive having space or not..?

 

Thank& Regards,

Ambesh

"Your satisfaction is very important to us. If you find above information helpful or it has resolved your issue. Please don't forget to mark the thread as solved."

Mugged's picture

Hi, 

Try following below mentinoed steps, it might help you resolve the issue.

1) Clear out definitions for a Symantec Endpoint Protection 12.1 client manually, 

http://www.symantec.com/business/support/index?pag...

2) run lucatalog -cleanup

3) run lucatalog -update

4) launch liveupdate from run (luall.exe)

5) check if that resolves the issue,if it does not

6) uninstall liveupdate from control panel/ add or remove

7) delete all the folders for the same, 

Delete C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate & C:\Program Files\Common Files\Symantec Shared\SymcData folders

8) Reinstall liveupdate, from CD1\SEPM\LUSETUP.EXE

9)  run lucatalog -cleanup & run lucatalog -update

10) Launch luall.exe from start run. 

 

 

 

Cheers,
Mugged.

haroldvm89's picture

After a clean installation, when downloading new content for the first time, i only got this:

With return code = 0, which i guess is Ok

 

Then, everytime i clic downloading [for new content], i got this:

 

I guess I'm not downloading updates for Virus and Spyware Definitions (most important!)

And in case you wonder, I see this when run luall.exe

Yes. Error LU1834. 

 

And another detail is that i cant see the definitions on the regedit

I'm sure that if i dont see the definitions in regedit, is because something is wrong with SEPM. Maybe SEPM or maybe Symantec Servers. I'm confused, and desperately need some help

 

SebastianZ's picture

- Regarding the registry look under: HKLM\Software\Wow6432Node\Symantec...

- Regarding LU1834 maybe this will help: http://www.symantec.com/docs/TECH174036

Félix_RS's picture

Haroldvm89, Is it worth more worthwhile you install a new server.

With the help of support symantec applied some suggested solutions on this page and the problem continued. Then the support symantec directed to create a new server and install the SEPM.

I installed a new server and configured the SEPM with embedded database within 6 hours. The new SEPM is working 7 days and have done successfully deploy in more than 150 clients. Attached evidence.

 

sepm_console.jpg
Vikram Kumar-SAV to SEP's picture

can you share the latest log.liveupdate

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.

Vikram Kumar-SAV to SEP's picture

Also check this

http://www.symantec.com/business/support/index?pag...

as your previous logs show Liveupdate exited with return code 100.

 

Also do you have a WebGateway ( Content Filtering ) in your network, just with its logs if it is stipping the definitions.

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.

Félix_RS's picture

Vikram Kumar, log.liveupdate you want mine? Or do you want the log Haroldvm89?

haroldvm89's picture

Thanks to anyone who posted in here.

The solution was external problems regarding a network firewall and IP blocked (not related with SEPM or symantec at all)

 

SOLUTION