Video Screencast Help
Scheduled Maintenance: Symantec Connect is scheduled to be down Saturday, April 19 from 10am to 2pm Pacific Standard Time (GMT: 5pm to 9pm) for server migration and upgrades.
Please accept our apologies in advance for any inconvenience this might cause.

Getting Error 1814 From Live Update

Created: 09 Sep 2013 • Updated: 11 Sep 2013 | 16 comments
This issue has been solved. See solution.

I have been running SEPM 12.1 and associated clients for a long time now.  Recenlty, I noticed that none of the definitions were updating.  I get the 1814 error when I try luall.exe.  I have tried many things like reinstalling liveupate and re-registering, etc.  I have always used a proxy and nothing has changed there.  Can you help?

Operating Systems:

Comments 16 CommentsJump to latest comment

_Brian's picture

Are you using any authentication for the proxy, could the credentials have changed recently?

can you post the log.liveupdate file for review?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Rafeeq's picture

are you getting this on SEPM or on client?

navigate to control pannel , select liveupdate set the proxy id and password

in the sepm under admin servers you will have option to update your id and pass for proxy, update the same.

then run catalog update. then run luall.exe...

if it fails then something might have  changed at your firewall end.

zubeb's picture

Credentials have not changed.  I know that since I need to type the same credentials in to authenticate with my web browser and that still works fine.  I am the one who runs the firewall so it would have to be me that would make a change and I know I have not done so.  I even went into where the credentials are stored and SEPM and in liveupdate 3.3 and re-typed both the username and the password in both places.  No dice.

_Brian's picture

You may need to examine the log.liveupdate file for errors.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

zubeb's picture

What should I be looking for?  Do you want to see the file?

Mithun Sanghavi's picture


In Symantec Endpoint Protection 12.1, 

For Liveupdate issue, you may require to check the log.liveupdate and log.lue for SEPM and SEP client respectively.

More detailed information about why LiveUpdate failed can be found in the following log file:s

<Drive>:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Log.LiveUpdate

LiveUpdate Engine creates a log file called Log.Lue, found in - 

On Windows XP and Windows server 2003:

C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs

On Windows Vista, Windows 7, and Windows Server 2008:

C:\Program Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs


However, for Communication issue - check the Sylink Logs - 

To enable the sylink and debug logs, check these Articles below:

How to debug the Symantec Endpoint Protection client
How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry


I would also suggest you to check the Articles below as well - 

How to Configure the Proxy settings in the Symantec Endpoint Protection Manager (SEPM) 12.1

Symantec Endpoint Protection: LiveUpdate Troubleshooting Flowchart


Hope that helps!!

Mithun Sanghavi
Senior Consultant

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

zubeb's picture

Will look over and might be back to you.  Thanks.

zubeb's picture

Can anyone tell me if symantec uses certain subdomain names or ip addresses that I would need to whitelist at my firewall.  My vendor suspects that traffic hitting is getting routed to subdomains that I need to open up.

_Brian's picture

They should all be in this KB article :

How to determine whether your firewall is blocking LiveUpdate

Article:TECH139451  |  Created: 2010-09-09  |  Updated: 2011-08-26  |  Article URL


Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

zubeb's picture

Nothing seems to be working.  Funny that the system has been updating itself for more than a year and I have not made any firewall changes.  Any other ideas?  I do think that my firewall guy is on to something.  Perhaps Symantec recently added other subdomains that need to be opened up?

_Brian's picture

Is it possible to allow all traffic from the SEPM just to test. not ideal, I know but just to quickly verify? Those domains have remain unchanged for as long as I can remember. If they did add another one, I would hope they would've sent out some sort of alert on it.

Is nothing showing in the fw log?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

zubeb's picture

I will try that on Tuesday and will let you know.

Mick2009's picture

Hi Zubeb,

Do attach the log.liveupdate (or at least the entries from its most recent session), if time allows.

Here are a few articles that describe the usual problems when an 1814 error code appears:

A LiveUpdate session run within the Symantec Endpoint Protection Manager fails with error LU1814

LiveUpdate concludes with Error code LU1814 while trying to update Symantec Endpoint Protection Manager Replication partner 


Also, make sure nothing has damaged your DNS resolution or HOSTS file:

Error: "LU1814: LiveUpdate could not retrieve the update list" (Enterprise) 

Many thanks in advance!


With thanks and best regards,


zubeb's picture

Hi folks:


This morning, I was able to directly connect between my ISP's cable modem and the second NIC on this particular server (for a direct, unfettered connection).  I told liveupdate and SEPM to not use a proxy and everything updated just fine.  Correct me if I am wrong, but this must mean that my firewall vendors must have updated its software or something that caused this problem.  I did not make any firewall changes and, if the problem was with liveupdate or SEPM, the bypass directly to the Internet would not have produced these favorable results.  Please let me know if you think it could be anything else.  At least for now, I can periodically connect directly and update my server.  It would be nice, however, to get back to the good old days of automatic updates.

Rafeeq's picture

may be the proxy details are incorrect for the system accocunt. 

Check this document open IE and see if it shows the correct proxy info

How to verify SYSTEM account proxy settings on Windows XP

zubeb's picture

This must be something internal to our firewall.  Updates to both the SEPM and the server's own instance of Enpoint Protection continue to work fine if the server is directly connected to the Internet.  If anything was wrong with the software, this would not be the case.  Thanks to all of you for your help in troubleshooting.