Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Endpoint Manager not updating via live update.....(Tried everything)

Created: 23 Nov 2012 • Updated: 23 Nov 2012 | 40 comments

Hi,

Our set-up is as follows

Endpoint Protection for Samll Business installed on 19 Client computers with a mix of XP & Win 7

Endpoint Manager installed on my PC (Windows 7)

All clients can connect to endpoint manager and show up in the interface, all have green icon in shiled in taskbar.

Each client can be updated manually via live update

The problem I have is the endpoint manager does seems to update but it is 'irregular', some clients seem to update but other do not, howeve rI am not sure if users have manually update without telling me or if they have done automatically if they cannot get instruction form the manager.

I know this topic has been discussed many times and I have searched this forum and tried virtually all fixes but still it does not work.

I can post logs here to see the failed manager connection to liveupdate but not sure how i obtain the logs?

Thank you for any help

Iain

Comments 40 CommentsJump to latest comment

iainb's picture

hi moderators could you please move this to the proper forum!

thank you

Triinu Gross's picture

Moved.

If your issue has been addressed, please use the "Mark as Solution" link for the relevant thread.

iainb's picture

i have just downloaded the latest virus definition files (.JDB file) and placed them in the  "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\inbox\content\incoming"

then selected all out of date clients and pushed the update, all clients now show the latest update.

however this does not solve the problem, how can i make sure the manager does this automatically?

thanks

iainb's picture

one question....

does the local PC with endpoint client installed need to have local ADMIN rights to enable auto update.

Mithun Sanghavi's picture

Hello,

Are you using any proxy?

What OS are you running on the SEPM server?

In your case, since you have updated Manager and all the clients with the Latest updates. we would not see much inside the Logs unless the SEPM try to update itself again.

I would request to upload us the log.liveupdate and log.lue from the server machine after if fails 2 - 3 more updates.

Log.Liveupdate could be found under:

Windows 2003: C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate

Windows 2008: C:\ProgramData\Symantec\LiveUpdate

Log.Lue could be found under:

On Windows XP and Windows server 2003:
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs

On Windows Vista, Windows 7, and Windows Server 2008:
C:\Program Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

iainb's picture

hi,

thank you for your reply,

to answer you questions,there is no proxy we have direct internet connection.

the SEPM server is installed on my pc with Windows 7.

after my previous post and successfully downloading JDB file i came into work this morning and tired the liveupdate form within the manager, the bleow is cut and pasted form the liveupdate window..

26 November 2012 08:57:12 GMT:  LiveUpdate failed.  [Server: Iain-PC]
26 November 2012 08:57:12 GMT:  LUALL.EXE finished running.  [Server: Iain-PC]
26 November 2012 08:57:12 GMT:  LiveUpdate encountered one or more errors. Return code = 4.  [Server: Iain-PC]
26 November 2012 08:57:11 GMT:  No updates found for Symantec Endpoint Protection Win64 12.1 (English).  [Server: Iain-PC]
26 November 2012 08:57:11 GMT:  No updates found for Symantec Endpoint Protection Win32 12.0.1001.95 (English).  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for Symantec Endpoint Protection Win32 12.1 (English).  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  Symantec Endpoint Protection Manager could not update Centralized Reputation Settings 12.1.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for SONAR scan engine Win32 11.0.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  Symantec Endpoint Protection Manager could not update AP Portal List 12.1 RU2.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for TruScan proactive threat scan commercial application list Win32 11.0.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for SONAR scan whitelist Win64 11.0.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  Symantec Endpoint Protection Manager could not update Virus and Spyware definitions Win32 12.1.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for Intrusion Prevention signatures Win64 11.0.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for Client Intrusion Detection System signatures 12.1.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  Symantec Endpoint Protection Manager could not update Revocation Data.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for SONAR scan engine Win64 11.0.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for Submission Control signatures 11.0.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for Submission Control signatures 12.1.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for SONAR scan data 11.0.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  Symantec Endpoint Protection Manager could not update Symantec Whitelist 12.1.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for SONAR Heuristics engine 12.1.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for SONAR scan whitelist Win32 11.0.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for TruScan proactive threat scan commercial application list Win64 11.0.  [Server: Iain-PC]
26 November 2012 08:57:10 GMT:  No updates found for SEPM LiveUpdate Database 12.1.  [Server: Iain-PC]
26 November 2012 08:57:09 GMT:  No updates found for SONAR scan commercial application engine 11.0.  [Server: Iain-PC]
26 November 2012 08:57:09 GMT:  Symantec Endpoint Protection Manager could not update Extended File Attributes and Signatures 12.1 RU2.  [Server: Iain-PC]
26 November 2012 08:57:09 GMT:  Symantec Endpoint Protection Manager could not update Virus and Spyware definitions Win64 12.1.  [Server: Iain-PC]
26 November 2012 08:57:09 GMT:  No updates found for Symantec Endpoint Protection Manager Content Catalog 12.1.  [Server: Iain-PC]
26 November 2012 08:57:09 GMT:  No updates found for Intrusion Prevention signatures Win32 11.0.  [Server: Iain-PC]
26 November 2012 08:57:03 GMT:  LUALL.EXE has been launched.  [Server: Iain-PC]
26 November 2012 08:57:03 GMT:  Download started.  [Server: Iain-PC]

could you confirm if this has failed? i have searched for code error 4 but nothing specific.

thank you

iain

Rafeeq's picture

Error code 4 always a result of proxy and sepm not able to reach internet.

can you check this document.

http://www.symantec.com/business/support/index?page=content&id=TECH103112

click on start

run

type luall.exe

does that run successfully?

iainb's picture

hi

thank you for your reply.

i ran luall.exe, the liveupdate box popped up and 'seemed' to run but then gave errors.

the following is what appeared in the box after it tried to update.

Opening update list
The digital signature found on the catalog file has been signed by Symantec Corporation.
Processing update list
Opening update list
Processing update list

The following updates have been found:
> SEPM Virus Definitions Win32 v12.1,  2723.0 KB
> SEPM Virus Definitions Win64 (x64) v12.1,  2728.7 KB
> SEPM Iron Whitelist v12.1,  11.8 KB
> SEPM Iron Revocation List v12.1,  677.5 KB
> SEPM Iron Settings v12.1,  7.6 KB
> SEPM SRTSP Settings,  7.5 KB
> SEPM Extended File Attributes and Signatures 12.1 RU2,  8.6 KB
Total Download 6164.7 KB

Downloading SEPM Virus Definitions Win32 v12.1 (1 of 1), complete.
Downloading SEPM Virus Definitions Win64 (x64) v12.1 (1 of 1), complete.
Downloading SEPM Iron Whitelist v12.1 (1 of 1), complete.
Downloading SEPM Iron Revocation List v12.1 (1 of 1), complete.
Downloading SEPM Iron Settings v12.1 (1 of 1), complete.
Downloading SEPM SRTSP Settings (1 of 1), complete.
Downloading SEPM Extended File Attributes and Signatures 12.1 RU2 (1 of 1), complete.

Installing SEPM Virus Definitions Win32 v12.1 (1 of 1), failed.
LU1832: LiveUpdate was unable to uncompress an update because the update was corrupted during its download. Please run LiveUpdate again to re-retrieve your updates.
Installing SEPM Virus Definitions Win64 (x64) v12.1 (1 of 1), failed.
LU1832: LiveUpdate was unable to uncompress an update because the update was corrupted during its download. Please run LiveUpdate again to re-retrieve your updates.
Installing SEPM Iron Whitelist v12.1 (1 of 1), failed.
LU1832: LiveUpdate was unable to uncompress an update because the update was corrupted during its download. Please run LiveUpdate again to re-retrieve your updates.
Installing SEPM Iron Revocation List v12.1 (1 of 1), failed.
LU1832: LiveUpdate was unable to uncompress an update because the update was corrupted during its download. Please run LiveUpdate again to re-retrieve your updates.
Installing SEPM Iron Settings v12.1 (1 of 1), failed.
LU1832: LiveUpdate was unable to uncompress an update because the update was corrupted during its download. Please run LiveUpdate again to re-retrieve your updates.
Installing SEPM SRTSP Settings (1 of 1), failed.
LU1832: LiveUpdate was unable to uncompress an update because the update was corrupted during its download. Please run LiveUpdate again to re-retrieve your updates.
Installing SEPM Extended File Attributes and Signatures 12.1 RU2 (1 of 1), failed.
LU1832: LiveUpdate was unable to uncompress an update because the update was corrupted during its download. Please run LiveUpdate again to re-retrieve your updates.

Installation failed, error summary...
LU1806: LiveUpdate downloaded all of the updates you requested, but all of them failed to install.  Please try to get the updates at a later time.

LiveUpdate session is complete.

Mithun Sanghavi's picture

Hello,

Which version of SEP 12.1 are running?

Check this Article in reference to the issue - 

LU1832, LU1825, LU1806 errors when running LiveUpdate on SEPM 12.1 RU1

http://www.symantec.com/docs/TECH185071

In case of SEP 12.1 RU1, check this Article

How to Uninstall and Reinstall LiveUpdate on SEPM 12.1 (Enterprise Edition or Small Business Edition)

http://www.symantec.com/docs/TECH171060

In case of SEP 12.1 RU1 MP1 and above, check this Article:

How to Uninstall and Reinstall LiveUpdate on SEPM 12.1.1101.401 RU1 MP1 (Enterprise Edition or Small Business Edition)

http://www.symantec.com/docs/TECH188850

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

iainb's picture

thanks again for the reply.

Current version os SEP manager is SEP 12.1 RU1 MP1

I uninstalled liveupdate version 3.1 and installed version 3.3

the liveupdate ran but only came back with the following (i did note it took much, much longer to come back with the following)..

27 November 2012 11:27:39 GMT:  LiveUpdate failed.  [Server: Iain-PC]
27 November 2012 11:27:39 GMT:  LUALL.EXE finished running.  [Server: Iain-PC]
27 November 2012 11:27:39 GMT:  LiveUpdate will start next on Tuesday, 27 November 2012 12:27:39 GMT on Iain-PC.  [Server: Iain-PC]
27 November 2012 11:27:39 GMT:  LiveUpdate encountered one or more errors. Return code = 4.  [Server: Iain-PC]
27 November 2012 11:27:38 GMT:  LUALL.EXE has been launched.  [Server: Iain-PC]
27 November 2012 11:27:28 GMT:  LiveUpdate started.  [Server: Iain-PC]
27 November 2012 11:26:28 GMT:  Retry timestamp is over the maximum retry window, switching to regular schedule run.  [Server: Iain-PC]
27 November 2012 11:23:22 GMT:  LiveUpdate failed.  [Server: Iain-PC]
27 November 2012 11:23:22 GMT:  LUALL.EXE finished running.  [Server: Iain-PC]
27 November 2012 11:23:21 GMT:  LiveUpdate encountered one or more errors. Return code = 4.  [Server: Iain-PC]
27 November 2012 11:23:20 GMT:  LUALL.EXE has been launched.  [Server: Iain-PC]
27 November 2012 11:23:10 GMT:  Download started.  [Server: Iain-PC]

i have a thought, how can i stop symantec taking over my local windows firewall, then turn the firewall off to see if it will update?

Mithun Sanghavi's picture

Hello,

Return code = 4 is a generic Error.

To understand the root cause of the issue, I would request to upload us the log.liveupdate and log.lue from the server machine after if fails 2 - 3 more updates.

Log.Liveupdate could be found under:

Windows 2003: C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate

Windows 2008: C:\ProgramData\Symantec\LiveUpdate

Log.Lue could be found under:

On Windows XP and Windows server 2003:
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs

On Windows Vista, Windows 7, and Windows Server 2008:
C:\Program Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

iainb's picture

Log.Liveupdate could be found under:

Windows 2003: C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate

Windows 2008: C:\ProgramData\Symantec\LiveUpdate

I could not find this file as the SEP manager is not on a server it is on my local machine.

Mithun Sanghavi's picture

Hello,

As per the lue.log, we see all the updates have taken place successfully.

Could you please disable the UAC from the Windows 7 machine and then restart the machine and check if that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

iainb's picture

hi,

please could you clarify exaclty what you mean by

"Could you please disable the UAC from the Windows 7 machine"?

cheers

iain

Mithun Sanghavi's picture

Hello,

UAC = User Account Control.

Work on the steps provided in the MS article below:

http://windows.microsoft.com/en-US/windows-vista/Turn-User-Account-Control-on-or-off

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

waelhilal's picture

You can try to do this following steps:

1.  Stop the SEPM and SEP Embedded Database in Services.

2.  Uninstall Live Update from Programs and Features or Add/Remove programs

3.  Install Live Update from the SEP setup CD

4.  Open a command window, then browse to:

C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin
Type lucatalog -update and press Enter.

5. Start the SEP Embedded Database service and then the SEPM service

6. Login into the SEPM and retry downloading updates from Live Update.

Hope it will fix your issue.

Thanks

Wael Hilal

Mobile: 00966531377132

iainb's picture

hi guys,

i tried the UAC and firewall suggestions, it still did not work.

however i tried the step in the last post above, stopping database service etc, re-installing liveupdate 3.3 and the following came back after i ran the liveupdate from within the SEP manager.

its seems to have worked???

how long does it take for the clients to update as none of them are shwoing todays date!?

29 November 2012 11:49:16 GMT:  LiveUpdate succeeded.  [Server: Iain-PC]
29 November 2012 11:49:16 GMT:  LUALL.EXE finished running.  [Server: Iain-PC]
29 November 2012 11:49:15 GMT:  LUALL.EXE successfully updated the content. Return code = 0.  [Server: Iain-PC]
29 November 2012 11:49:14 GMT:  No updates found for Symantec Endpoint Protection Win64 12.1 (English).  [Server: Iain-PC]
29 November 2012 11:49:14 GMT:  No updates found for Symantec Endpoint Protection Win32 12.0.1001.95 (English).  [Server: Iain-PC]
29 November 2012 11:49:14 GMT:  No updates found for Symantec Endpoint Protection Win32 12.1 (English).  [Server: Iain-PC]
29 November 2012 11:49:14 GMT:  Symantec Endpoint Protection Manager could not update Centralized Reputation Settings 12.1.  [Server: Iain-PC]
29 November 2012 11:49:14 GMT:  No updates found for SONAR scan engine Win32 11.0.  [Server: Iain-PC]
29 November 2012 11:49:14 GMT:  Symantec Endpoint Protection Manager could not update AP Portal List 12.1 RU2.  [Server: Iain-PC]
29 November 2012 11:49:13 GMT:  Successfully downloaded the TruScan proactive threat scan commercial application list Win32 11.0 security definitions from LiveUpdate. The security definitions are now available for deployment.  [Server: Iain-PC]
29 November 2012 11:49:13 GMT:  Cleaned up 1 LiveUpdate downloaded content  [Server: Iain-PC]
29 November 2012 11:48:59 GMT:  Successfully downloaded the SONAR scan whitelist Win64 11.0 security definitions from LiveUpdate. The security definitions are now available for deployment.  [Server: Iain-PC]
29 November 2012 11:48:59 GMT:  Cleaned up 1 LiveUpdate downloaded content  [Server: Iain-PC]
29 November 2012 11:48:50 GMT:  Symantec Endpoint Protection Manager could not update Virus and Spyware definitions Win32 12.1.  [Server: Iain-PC]
29 November 2012 11:48:49 GMT:  Successfully downloaded the Intrusion Prevention signatures Win64 11.0 security definitions from LiveUpdate. The security definitions are now available for deployment.  [Server: Iain-PC]
29 November 2012 11:48:49 GMT:  Cleaned up 1 LiveUpdate downloaded content  [Server: Iain-PC]
29 November 2012 11:48:42 GMT:  Successfully downloaded the Client Intrusion Detection System signatures 12.1 security definitions from LiveUpdate. The security definitions are now available for deployment.  [Server: Iain-PC]
29 November 2012 11:48:41 GMT:  Cleaned up 1 LiveUpdate downloaded content  [Server: Iain-PC]
29 November 2012 11:48:34 GMT:  Symantec Endpoint Protection Manager could not update Revocation Data.  [Server: Iain-PC]
29 November 2012 11:48:34 GMT:  No updates found for SONAR scan engine Win64 11.0.  [Server: Iain-PC]
29 November 2012 11:48:34 GMT:  No updates found for Submission Control signatures 11.0.  [Server: Iain-PC]
29 November 2012 11:48:34 GMT:  No updates found for Submission Control signatures 12.1.  [Server: Iain-PC]
29 November 2012 11:48:34 GMT:  No updates found for SONAR scan data 11.0.  [Server: Iain-PC]
29 November 2012 11:48:34 GMT:  Symantec Endpoint Protection Manager could not update Symantec Whitelist 12.1.  [Server: Iain-PC]
29 November 2012 11:48:34 GMT:  No updates found for SONAR Heuristics engine 12.1.  [Server: Iain-PC]
29 November 2012 11:48:34 GMT:  Successfully downloaded the SONAR scan whitelist Win32 11.0 security definitions from LiveUpdate. The security definitions are now available for deployment.  [Server: Iain-PC]
29 November 2012 11:48:34 GMT:  Cleaned up 1 LiveUpdate downloaded content  [Server: Iain-PC]
29 November 2012 11:48:24 GMT:  Successfully downloaded the TruScan proactive threat scan commercial application list Win64 11.0 security definitions from LiveUpdate. The security definitions are now available for deployment.  [Server: Iain-PC]
29 November 2012 11:48:24 GMT:  Cleaned up 1 LiveUpdate downloaded content  [Server: Iain-PC]
29 November 2012 11:48:23 GMT:  No updates found for SEPM LiveUpdate Database 12.1.  [Server: Iain-PC]
29 November 2012 11:48:23 GMT:  No updates found for SONAR scan commercial application engine 11.0.  [Server: Iain-PC]
29 November 2012 11:48:23 GMT:  Symantec Endpoint Protection Manager could not update Extended File Attributes and Signatures 12.1 RU2.  [Server: Iain-PC]
29 November 2012 11:48:23 GMT:  Symantec Endpoint Protection Manager could not update Virus and Spyware definitions Win64 12.1.  [Server: Iain-PC]
29 November 2012 11:48:23 GMT:  No updates found for Symantec Endpoint Protection Manager Content Catalog 12.1.  [Server: Iain-PC]
29 November 2012 11:48:23 GMT:  Successfully downloaded the Intrusion Prevention signatures Win32 11.0 security definitions from LiveUpdate. The security definitions are now available for deployment.  [Server: Iain-PC]
29 November 2012 11:48:23 GMT:  Cleaned up 1 LiveUpdate downloaded content  [Server: Iain-PC]
29 November 2012 11:47:01 GMT:  LUALL.EXE has been launched.  [Server: Iain-PC]
29 November 2012 11:47:00 GMT:  Download started.  [Server: Iain-PC]

iainb's picture

i would like to add, in the SEP Manager windows my PC still shows virus definition of 11/12/2012 r20

however when i go to my local endpoint i clicked liveupdate and it downloaded latest definitions and it states 28 November 2012 r21?

please advise?

iainb's picture

further news, i clicked refresh in SEP manager and now it shows my pc has the 28th virus update.

i hav enoticed 'SOME' users PCs are updating fine but other are not also?

iainb's picture

just checked again this morning, can you confirm if it has worekd?

30 November 2012 10:15:55 GMT:  LiveUpdate failed.  [Server: Iain-PC]
30 November 2012 10:15:55 GMT:  LUALL.EXE finished running.  [Server: Iain-PC]
30 November 2012 10:15:55 GMT:  LiveUpdate encountered one or more errors. Return code = 4.  [Server: Iain-PC]
30 November 2012 10:15:54 GMT:  No updates found for Symantec Endpoint Protection Win64 12.1 (English).  [Server: Iain-PC]
30 November 2012 10:15:54 GMT:  No updates found for Symantec Endpoint Protection Win32 12.0.1001.95 (English).  [Server: Iain-PC]
30 November 2012 10:15:54 GMT:  No updates found for Symantec Endpoint Protection Win32 12.1 (English).  [Server: Iain-PC]
30 November 2012 10:15:54 GMT:  Symantec Endpoint Protection Manager could not update Centralized Reputation Settings 12.1.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for SONAR scan engine Win32 11.0.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  Symantec Endpoint Protection Manager could not update AP Portal List 12.1 RU2.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for TruScan proactive threat scan commercial application list Win32 11.0.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for SONAR scan whitelist Win64 11.0.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  Symantec Endpoint Protection Manager could not update Virus and Spyware definitions Win32 12.1.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for Intrusion Prevention signatures Win64 11.0.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for Client Intrusion Detection System signatures 12.1.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  Symantec Endpoint Protection Manager could not update Revocation Data.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for SONAR scan engine Win64 11.0.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for Submission Control signatures 11.0.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for Submission Control signatures 12.1.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for SONAR scan data 11.0.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  Symantec Endpoint Protection Manager could not update Symantec Whitelist 12.1.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for SONAR Heuristics engine 12.1.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for SONAR scan whitelist Win32 11.0.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for TruScan proactive threat scan commercial application list Win64 11.0.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for SEPM LiveUpdate Database 12.1.  [Server: Iain-PC]
30 November 2012 10:15:53 GMT:  No updates found for SONAR scan commercial application engine 11.0.  [Server: Iain-PC]
30 November 2012 10:15:52 GMT:  Symantec Endpoint Protection Manager could not update Extended File Attributes and Signatures 12.1 RU2.  [Server: Iain-PC]
30 November 2012 10:15:52 GMT:  Symantec Endpoint Protection Manager could not update Virus and Spyware definitions Win64 12.1.  [Server: Iain-PC]
30 November 2012 10:15:52 GMT:  No updates found for Symantec Endpoint Protection Manager Content Catalog 12.1.  [Server: Iain-PC]
30 November 2012 10:15:52 GMT:  No updates found for Intrusion Prevention signatures Win32 11.0.  [Server: Iain-PC]
30 November 2012 10:15:45 GMT:  LUALL.EXE has been launched.  [Server: Iain-PC]
30 November 2012 10:15:45 GMT:  Download started.  [Server: Iain-PC]

iainb's picture

i checked our BT firewall and it is not blocking the ports, i could not gain access to my local firewall on the pc as symantec SEP has taken over it.

No clients have a December update they are all november still!!??

just logged onto SEP manager this morning and got this... has this run ok? or has it failed?

03 December 2012 08:32:52 GMT:  LiveUpdate failed.  [Server: Iain-PC]
03 December 2012 08:32:52 GMT:  LUALL.EXE finished running.  [Server: Iain-PC]
03 December 2012 08:32:52 GMT:  LiveUpdate encountered one or more errors. Return code = 4.  [Server: Iain-PC]
03 December 2012 08:32:51 GMT:  No updates found for Symantec Endpoint Protection Win64 12.1 (English).  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for Symantec Endpoint Protection Win32 12.0.1001.95 (English).  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for Symantec Endpoint Protection Win32 12.1 (English).  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  Symantec Endpoint Protection Manager could not update Centralized Reputation Settings 12.1.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for SONAR scan engine Win32 11.0.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  Symantec Endpoint Protection Manager could not update AP Portal List 12.1 RU2.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for TruScan proactive threat scan commercial application list Win32 11.0.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for SONAR scan whitelist Win64 11.0.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  Symantec Endpoint Protection Manager could not update Virus and Spyware definitions Win32 12.1.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for Intrusion Prevention signatures Win64 11.0.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for Client Intrusion Detection System signatures 12.1.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  Symantec Endpoint Protection Manager could not update Revocation Data.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for SONAR scan engine Win64 11.0.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for Submission Control signatures 11.0.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for Submission Control signatures 12.1.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for SONAR scan data 11.0.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  Symantec Endpoint Protection Manager could not update Symantec Whitelist 12.1.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for SONAR Heuristics engine 12.1.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for SONAR scan whitelist Win32 11.0.  [Server: Iain-PC]
03 December 2012 08:32:50 GMT:  No updates found for TruScan proactive threat scan commercial application list Win64 11.0.  [Server: Iain-PC]
03 December 2012 08:32:49 GMT:  No updates found for SEPM LiveUpdate Database 12.1.  [Server: Iain-PC]
03 December 2012 08:32:49 GMT:  No updates found for SONAR scan commercial application engine 11.0.  [Server: Iain-PC]
03 December 2012 08:32:49 GMT:  Symantec Endpoint Protection Manager could not update Extended File Attributes and Signatures 12.1 RU2.  [Server: Iain-PC]
03 December 2012 08:32:49 GMT:  Symantec Endpoint Protection Manager could not update Virus and Spyware definitions Win64 12.1.  [Server: Iain-PC]
03 December 2012 08:32:49 GMT:  No updates found for Symantec Endpoint Protection Manager Content Catalog 12.1.  [Server: Iain-PC]
03 December 2012 08:32:49 GMT:  No updates found for Intrusion Prevention signatures Win32 11.0.  [Server: Iain-PC]
03 December 2012 08:32:36 GMT:  LUALL.EXE has been launched.  [Server: Iain-PC]
03 December 2012 08:32:36 GMT:  Download started.  [Server: Iain-PC]

iainb's picture

The following Symantec products and components are installed on your computer:

> Virus and Spyware Definitions Win64
> Centralized Reputation Settings
> Intrusion Prevention Signatures (hub)
> Intrusion Prevention Signatures
> Revocation Data
> Submission Control Thresholds
> SONAR Definitions
> Symantec Whitelist
> Virus and Spyware Definitions Win64 (hub)

Initializing...
Connecting to liveupdate.symantecliveupdate.com...
Connected to LiveUpdate server successfully.

There are 9 update(s) to be downloaded.
Downloading catalog file (1 of 9) finished.
Downloading catalog file (2 of 9) finished.
Downloading catalog file (3 of 9) finished.
Downloading catalog file (4 of 9) finished.
Downloading catalog file (5 of 9) finished.
Downloading catalog file (6 of 9) finished.
Downloading catalog file (7 of 9) finished.
Downloading catalog file (8 of 9) finished.
Downloading catalog file (9 of 9) finished.

Update available for Virus and Spyware Definitions Win64.
Update available for Revocation Data.
Update available for Symantec Whitelist.

There are 3 update(s) to be downloaded.
Downloading update package (1 of 3), 100% complete.
Downloading update package (2 of 3), 100% complete.
Downloading update package (3 of 3), 100% complete.
3 update(s) have been downloaded.

Processing updates...
Installed update for Virus and Spyware Definitions Win64 successfully.
Installed update for Revocation Data successfully.
Installed update for Symantec Whitelist successfully.
Finalizing updates...

Session summary: 3 update(s) available, 3 update(s) installed.
LiveUpdate session is complete.

W007's picture

Hi,

As Per log you have received error.

03 December 2012 08:32:52 GMT:  LiveUpdate failed.  [Server: Iain-PC]
03 December 2012 08:32:52 GMT:  LUALL.EXE finished running.  [Server: Iain-PC]
03 December 2012 08:32:52 GMT:  LiveUpdate encountered one or more errors. Return code = 4.  [Server: Iain-PC]

 

"Error: LiveUpdate encountered one or more errors. Return code = 4" in LiveUpdate status in Symantec Endpoint Protection Manager

http://www.symantec.com/business/support/index?page=content&id=TECH103112

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

iainb's picture

hi,

ive tried all that.

we seem to be going round in circles now, is there anyway we can esculate my problem, we have spent over £700 on this product, is there a way a technical support engineer can 'take over' my pc and try to fix this problem at source?

thank you

W007's picture

HI,

You can raised the support ticket

http://www.symantec.com/support/assistance_care.jsp

QuickStart Guide - Create and Manage Support Cases in SymWISE

http://www.symantec.com/docs/HOWTO31132

How to update a support case and upload diagnostic files with MySupport

http://www.symantec.com/docs/TECH71023

OR

Regional Support Telephone Numbers:

United States: 800-342-0652 (407-357-7600 from outside the United States)

Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)

United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/business/support/contact_techsupp_static.jsp

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

iainb's picture

Below is the view form the SEP manager of all our clients, it seems some do update, however i am not sure if people have done the update manaully OR if the sep manager has done it? i guess users have done it manually.

AlunE-XP Offline alunevans 29 November 2012 16:14 11/28/2012 r21 0A88-11/13/2012 14:25:21 859 29 November 2012 13:51 Enabled Enabled No  
CHRIS-XP2 Offline chrisjones 30 November 2012 15:14 11/27/2012 r21 0A88-11/13/2012 14:25:21 859 30 November 2012 09:00 Enabled Enabled No  
Iain-PC Online iainbramald 03 December 2012 09:25 12/02/2012 r7 0A88-11/13/2012 14:25:21 859 03 December 2012 08:46 Enabled Enabled No  
ibailey-laptop Online ianbailey 03 December 2012 09:24 12/02/2012 r7 0A88-11/13/2012 14:25:21 859 03 December 2012 07:48 Enabled Enabled No  
Inspection-2012 Online inspection 03 December 2012 09:20 11/29/2012 r23 0A88-11/13/2012 14:25:21 859 03 December 2012 07:32 Enabled Enabled No  
Jack-2011PC Online jskyrm 03 December 2012 09:24 11/27/2012 r21 0A88-11/13/2012 14:25:21 859 03 December 2012 08:23 Enabled Enabled No  
Jayne-XP Online jthomas 03 December 2012 09:23 11/27/2012 r21 0A88-11/13/2012 14:25:21 859 03 December 2012 08:11 Enabled Enabled No  
JOHN-XP-2010 Online jgreathead 03 December 2012 09:22 12/02/2012 r7 0A88-11/13/2012 14:25:21 859 03 December 2012 08:16 Enabled Enabled No  
Kevin-2012 Online klaing 03 December 2012 09:25 11/27/2012 r21 0A88-11/13/2012 14:25:21 859 03 December 2012 08:23 Enabled Enabled No  
Lee-2011 Online leebramald 03 December 2012 09:23 11/28/2012 r21 0A88-11/13/2012 14:25:21 859 03 December 2012 08:32 Enabled Enabled No  
Lloyd-2011 Online drafty3 03 December 2012 09:20 12/02/2012 r7 0A88-11/13/2012 14:25:21 859 03 December 2012 07:49 Enabled Enabled No  
Pauline-XP-08 Online paulineemery 03 December 2012 09:26 11/27/2012 r21 0A88-11/13/2012 14:25:21 859 03 December 2012 08:14 Enabled Enabled No  
Phil-2012 Online phil 03 December 2012 09:24 11/29/2012 r23 0A88-11/13/2012 14:25:21 859 03 December 2012 08:25 Enabled Enabled No  
PhilP-XP Online pperkins 03 December 2012 09:24 12/02/2012 r7 0A88-11/13/2012 14:25:21 859 03 December 2012 07:44 Enabled Enabled No  
RADAN-2-XP Online radan 03 December 2012 09:24 11/22/2012 r20 0A88-11/13/2012 14:25:21 859 03 December 2012 01:58 Enabled Enabled No  
Reception-PC Online reception 03 December 2012 09:20 11/27/2012 r21 0A88-11/13/2012 14:25:21 859 03 December 2012 08:23 Enabled Enabled No  
Steve-2012 Offline steveedwards 03 December 2012 08:52 12/02/2012 r7 0A88-11/13/2012 14:25:21 859 03 December 2012 07:34 Enabled Enabled No  
stores-xp Offline stores 30 November 2012 12:16 11/29/2012 r9 0A88-11/13/2012 14:25:21 859 30 November 2012 07:24 Enabled Enabled No  
tim-2012 Online tim 03 December 2012 09:20 11/28/2012 r21 0A88-11/13/2012 14:25:21 859 03 December 2012 07:56 Enabled Enabled No  
W007's picture

Hi,

Check your SEPM Manager are updated or not ?

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

iainb's picture

on sep manager it stes the following....

Windows Definitions  
Latest from Symantec: 02/12/2012 r7
Latest on Manager: 22/11/2012 r20
W007's picture

Yes i think Some of system upgrade manually.

You can raised support ticket for same..

How to update definitions for Symantec Endpoint Protection Manager (SEPM) using a .jdb file

http://www.symantec.com/business/support/index?page=content&id=TECH102607

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

iainb's picture

sorry im confiused now are you saying this is resolved, i have tried the JDB file!

W007's picture

No,

Your SEPM manager still not update automatic,

You can raised support ticket.

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

iainb's picture

im sorry for sounding dull by what willhappen if i raise a support ticket? how do i do this?

W007's picture

Hi,

When you will be raised support ticket any symantec techinal person take control your server and will be fix your issue.

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

pete_4u2002's picture

doesn't copying jdb file into respective folder update the SEPM? is the jdb file still present?

iainb's picture

i have been through the JDB routine and it does update.

can you please...

1 - send me link to latest JDB file

2 - tell me how to open support ticket

thank you

W007's picture

Download JDB file

http://www.symantec.com/security_response/definitions/download/detail.jsp?gid=savce

tell me how to open support ticket

Regional Support Telephone Numbers:

United States: 800-342-0652 (407-357-7600 from outside the United States)

Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)

United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/business/support/contact_techsupp_static.jsp

http://www.symantec.com/support/assistance_care.jsp

QuickStart Guide - Create and Manage Support Cases in SymWISE

http://www.symantec.com/docs/HOWTO31132

How to update a support case and upload diagnostic files with MySupport

http://www.symantec.com/docs/TECH71023

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.