Endpoint Protection

Hi everyone,

Since last 15.05.2015, we have found that within our environment, the number of attempts to download full content updates for virus definitions have increased incredibly. Before that date, it was rare to see an event of a full download (we have hundreds of GUPs distributing updates which make the environment very stable). However, on 15.05 we started to be informed about unusual traffic caused by Symantec. And today 18.05, we have seen that more than 1200 machines have tried to download the full package. The reason is not a very old definitions file. What happens is that delta update is downloaded and when installed it gives this error:

"An update for Virus and Spyware Definitions Win64 failed to install.  Error: 0xE0010001, DuResult: 37. ".

After that failure, during the next heartbeat the full content is downloaded. I know this can happen if the update fails and corrupt the definitions but it is not acceptable to see this happening so so frequently. There may be something wrong with recent definitions files.. Is anyone experiencing this issue? Is Symantec aware of this? Is our company the only one suffering from this?

Many thanks!

Could be related to the new content structure:

FAQ: Core 1.5 definitions for Endpoint Protection 12.1

Thanks Brian. I thought of that as well (Symantec is doing so many changes on Defs that have done something wrong with latest definitions) but I am not sure and definitely it is not acceptable (each full content causes an average of 700MB download per machine as per our network metrics...)

You're not alone, we suffered from this as well - we had to change some settings including throtting down the bandwidth within Apache config - things have stablised for now. You might want to do this as well if you're still suffering network issue.

See https://support.symantec.com/en_US/article.TECH201290.html

Hope this will help you.

Tony

Many thanks Tony for the article. We are still at 12.1 RU4 but we'll look into this article in deep when we move to RU5, specially in case people starts complaining about excessive bandwidth usage...

ps.: Happy to know I am not alone :)

No problem, hopefully the link that I sent you will help you out to reduce the network load.

Feel free to mark this as the answer.

Cheers,

Tony

Although it is not 100% the solution for my problem (error when installing Defs), I marked that as solution because it was a great piece of advice. Thanks!