Endpoint Protection

Hi all,
I require some assistance with regards to my implementation of group update providers. I am having trouble with the group update providers not downloading content updates for local clients and distributing it to the shared updates folder.

#####  Here is my setup #####
Head Office and State Office connected via VPN

Head Office - SEP Manager v11 MR4 - 10.0.8.1
         - State Office Client Group
         - Liveupdate Policy specifies
                           - Use a group update provider - 10.0.40.1 - Never Bypass

State Office
          - Connected via VPN
          - Local file server - 10.0.40.1 - no firewall - clients can telnet to 2967
          - All Clients on 10.0.40.* subnet using SEP v11 MR4
          - All Clients local firewall : 2967 open (8014 open also, for testing)

VPN link firewall:
          - Port 8014, 443 open to 10.0.8.1 for client/server communications.


##### MY INSTALLATION PROCEDURE #####

- Ensure all clients, including the intended group update provider are in the same client group on the management server
- Create the install package - initial package specifies to get updates from the management server - publish this package to local state office file server 10.0.40.1
- Deploy clients via deployment wizard, pointing them to the local package previously exported
- Clients install fine and initial liveupdate works without issues
- Once clients are updated - apply liveupdate policy specifying 10.0.40.1 as the group update provider
- Confirmed via system log on 10.0.40.1 that it is now "serving as the group update provider" - 10.0.40.1
- Confirmed that client system logs now specify "using group update provider 10.0.40.1
- HERE IS THE PUNCH LINE:
-  The clients never get past this revision of updates and if i deploy a new client to that group it sits with its initial deployment updates forever, it never gets its update from the group update provider.
- Ive checked the group update provider (10.0.40.1) and the sharedupdates folder is populated with a number of < 1mb files, there are no definition packages in there?!
      - #content#{812CD25E-1049-4086-9DDD-A4FAE649FBDF}#90521018#xdelta90519018!dax  - 56KB  (Definitions packages should be 40-50MB not KB)

It is my understanding that when a new client comes on board and requests an update from the group update provider it should download the update from the management server and publish it into the shared updates folder. This is just not happening. The client will just sit there with definitions years out of date.

If someone could please give me some tips / advice as to why my GUPs arent downloading content and publishing it to the sharedupdates folder I would be greatly appreciative. I have checked the GUP machines registry and it is definitely identifying itself as a GUP with the correct IP and listening port. I have also confirmed that the smc.exe process is indeed listening on 2967 however, it doesnt matter how much you listen, if you dont have the updates in the sharedupdates folder for the clients to retrieve, its just not going to happen.

I cant understand that, during deployment, all clients happily updated their definitions and content (over the vpn) however now, once my GUP policy is applied, only the GUP client is getting its definition updates (because policy states that the GUP can get updates from management server but clients can NEVER bypass the GUP) and it is not publishing these updates to sharedupdates.

Also,
Please do NOT direct me to one of the following GUP related articles below because I have been through them and they are not of any assistance in my case.

http://service1.symantec.com/SUPPORT/ent-security....
http://service1.symantec.com/SUPPORT/ent-security....
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008040113243148
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007091010224248

Look forward to a response, kind regards.

Are you running WSUS on your GUP?  Have you used the Sylink Monitor utility and if so can you post the logs?  In the third link you posted, have you tried enabling debugging mode and examined the debug.log in the SEP folder?   It sounds like you have everything setup correctly, but the extra debugging would help.

Hi Rick,  Thanks for the reply
No, the GUP machine is not running WSUS however a future upgrade to this network did have intentions for doing so. Out of curiosity, is this an issue?

Back to this case.
This is my Sylink log after restarting smc on the Group Update Provider PC.
If you still need the debug.log file let me, its pretty dense. I have bolded some entries which may be related I am unsure.

05/22 12:11:36 [2436] ~~~Sylink log started. (SEP Product Version in registry: 11.0.4000.2295, Sylink File Version: 11.0.4000.2261)
05/22 12:11:36 [2436] Stored HostGUID=7C65CD080A000801016F81C125BA0873; outlen=16
05/22 12:11:36 [2436] <RestoreSettings>Stored UserGuid=0; outlen=2
05/22 12:11:36 [2436] <mfn_DecodeSSN>Sygate-SSN=203
05/22 12:11:36 [2436] <mfn_DecodeSSN>Read CSN=204
05/22 12:11:36 [2436] Product Type=3,Major Ver=5,Minor Ver=2,Platform ID=2,OSType=50659842
05/22 12:11:36 [2436] OS=Windows Server 2003 family Standard Edition; number=5.2.3790
05/22 12:11:36 [2436] SyLinkCreateInstance => Instance created: 01B4CE08 Registry path: SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK
05/22 12:11:36 [2436] <GetOnlineNicInfo>:Netport Count=1
05/22 12:11:36 [2436] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="10.0.40.1" Mac="00-1c-25-c1-f5-d3" Gateway="10.0.40.254" SubnetMask="0.0.0.0"/></SSANICs>
05/22 12:11:36 [2436] SyLinkCreateConfig => Created instance: 01B59FC0
05/22 12:11:36 [2436] UseNewConfig => Created m_hNewConfig: 01B59FC0
05/22 12:11:36 [2436] Importing ConfigObject: 01B6E358 into: 01B59FC0
05/22 12:11:36 [2436] Importing ConfigObject: 01B6E358 into: 01B58338
05/22 12:11:36 [2436] <PostEvent>stopping...ignore event ID=EVENT_SYLINK_CONFIG_SETTING_CHANGED
05/22 12:11:36 [2436] SSA packageType is set as 105
05/22 12:11:36 [2436] SyLinkDeleteConfig => Deleting instance: 01B6E358
05/22 12:11:36 [2436] <SetHiStatus>HI status is changed to=3; reason=0; rule=Host Integrity check is disabled.
Host Integrity policy has been disabled by the administrator.
05/22 12:11:36 [2436] SyLinkCreateConfig => Created instance: 02DC36C8
05/22 12:11:36 [2436] SetCurLocationName: Name is set to - WA State Office
05/22 12:11:36 [2436] SetCurLocationID: ID is set to - 612C98580A00080101565A99A70B455D
05/22 12:11:36 [2436] SyLinkCreateConfig => Created instance: 02DC4968
05/22 12:11:36 [2436] Importing ConfigObject: 02DC4968 into: 01B59FC0
05/22 12:11:36 [2436] Importing ConfigObject: 02DC4968 into: 01B58338
05/22 12:11:36 [2436] <PostEvent>stopping...ignore event ID=EVENT_SYLINK_CONFIG_SETTING_CHANGED
05/22 12:11:36 [2436] SyLinkDeleteConfig => Deleting instance: 02DC4968
05/22 12:11:37 [2436] SyLinkDeleteConfig => Deleting instance: 02DC36C8
05/22 12:11:37 [2436] <CSyLink::Start()>
05/22 12:11:37 [2436] <CSyLink::ImportConfigFile()>
05/22 12:11:37 [2436] CUpdateConfig::Dump
05/22 12:11:37 [2436] </CSyLink::ImportConfigFile()>
05/22 12:11:37 [2436] <GetDomainHostName>msz_DomainName is taken from szDomainName
05/22 12:11:37 [2436] <GetDomainHostName>DomainName (Final)=REMOVED FOR PRIVACY
05/22 12:11:37 [2436] *********Netport Count=1
05/22 12:11:37 [2436] Physical: Local Area Connection::00-1c-25-c1-f5-d3::broadcom netlink (tm) gigabit ethernet
05/22 12:11:37 [2436] MAC=00-1c-25-c1-f5-d3# Wireless=
05/22 12:11:37 [2436] Hardwire String=00-1c-25-c1-f5-d3#
05/22 12:11:37 [2436] <Start>Unable to create Session with 'No Proxies' settings - Error Code: 87
05/22 12:11:37 [3332] <ScheduleNextUpdate>Manually assigned heartbeat=327 seconds
05/22 12:11:37 [3320] <HeartbeatThreadProc:>Thread is about to begin..
05/22 12:11:37 [3332] Successfully created the heartbeat thread
05/22 12:11:37 [2436] <Start>Started, contact SMS every 600 seconds
05/22 12:11:37 [2436] <PostEvent>going to post event=EVENT_SYLINK_CONFIG_SETTING_CHANGED
05/22 12:11:37 [2436] <PostEvent>done post event=EVENT_SYLINK_CONFIG_SETTING_CHANGED, return=0
05/22 12:11:37 [2436] </CSyLink::Start()>
05/22 12:11:37 [924] <CExpBackoff::CExpBackoff()>
05/22 12:11:37 [924] </CExpBackoff::CExpBackoff()>
05/22 12:11:37 [2436] <SetClientAuth>Received new User/Domain from SMC.. User: jbennett User Domain: REMOVED FOR PRIVACY
05/22 12:11:37 [2436] <SetClientAuth>Getting RDNS Domain Name (user domain in AD setup)..
05/22 12:11:37 [2436] <GetLoginRdnsDomain>DNS domain=IREMOVED FOR PRIVACY
05/22 12:11:37 [2436] <SetClientAuth>Setting the User Domain to RDNS Domain ..
05/22 12:11:37 [2436] <SetClientAuth>Logged in user info set to:REMOVED FOR PRIVACY
05/22 12:11:37 [2436] <SetClientAuth>Marking User Change Notify to redo registration..
05/22 12:11:38 [3320] <CheckHeartbeatTimer>====== Heartbeat loop starts at 12:11:38 ======
05/22 12:11:38 [3320] <GetOnlineNicInfo>:Netport Count=1
05/22 12:11:38 [3320] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="10.0.40.1" Mac="00-1c-25-c1-f5-d3" Gateway="10.0.40.254" SubnetMask="0.0.0.0"/></SSANICs>
05/22 12:11:39 [3320] <CalcAgentHashKey>:CH=51D6C1A40A00080101D0E2D2B07B3E2AREMOVED FOR PRIVACY280CAE9608EB7161B915A1F6DD9F120B
05/22 12:11:39 [3320] <CalcAgentHashKey>:CHKey=DE8307C107F16B7CE406786959387FC1
05/22 12:11:39 [3320] <CalcAgentHashKey>:C=51D6C1A40A00080101D0E2D2B07B3E2A1REMOVED FOR PRIVACY
05/22 12:11:39 [3320] <CalcAgentHashKey>:CKey=DDF72F96D505903E9B26488AD75F8934
05/22 12:11:39 [3320] <CalcAgentHashKey>:UCH=51D6C1A40A00080101D0E2D2B07B3E2A0REMOVED FOR PRIVACY280CAE9608EB7161B915A1F6DD9F120B
05/22 12:11:39 [3320] <CalcAgentHashKey>:UCHKey=9C247830097733A9B7037A12B5A02857
05/22 12:11:39 [3320] <CalcAgentHashKey>:UC=51D6C1A40A00080101D0E2D2B07B3E2A0REMOVED FOR PRIVACY
05/22 12:11:39 [3320] <CalcAgentHashKey>:UCKey=9E1735C9853BA39AFE8A81D9E64F8091
05/22 12:11:39 [3320] <DoHeartbeat>HardwareID=280CAE9608EB7161B915A1F6DD9F120B
05/22 12:11:39 [3320] <DoHeartbeat>CHKey=DE8307C107F16B7CE406786959387FC1
05/22 12:11:39 [3320] <DoHeartbeat>CKey=DDF72F96D505903E9B26488AD75F8934
05/22 12:11:39 [3320] <DoHeartbeat>UCHKey=9C247830097733A9B7037A12B5A02857
05/22 12:11:39 [3320] <DoHeartbeat>UCKey=9E1735C9853BA39AFE8A81D9E64F8091
05/22 12:11:39 [3320] <DoHeartbeat> Set heartbeat event
05/22 12:11:39 [3320] Use new configuration
05/22 12:11:39 [3320] <RegHeartbeatProc>====== Reg Heartbeat loop starts at 12:11:39 ======
05/22 12:11:39 [3892] SyLinkCreateConfig => Created instance: 01ABC4D8
05/22 12:11:39 [3892] Importing ConfigObject: 01B58338 into: 01ABC4D8
05/22 12:11:39 [3892] SyLinkDeleteConfig => Deleting instance: 01ABC4D8
05/22 12:11:39 [3320] HEARTBEAT: Check Point 1
05/22 12:11:39 [3320] HEARTBEAT: Check Point 2
05/22 12:11:39 [3320] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
05/22 12:11:39 [3320] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
05/22 12:11:39 [3320] HEARTBEAT: Check Point 3
05/22 12:11:39 [3320] <RegHeartbeatProc>Setting the session timeout on Profile Session (Registration) to 30000
05/22 12:11:39 [3320] HEARTBEAT: Check Point 4
05/22 12:11:39 [3320] <RegHeartbeatProc>===Registration STAGE===
05/22 12:11:39 [3320] <MakeRegisterData:>logon id (domain/user)=REMOVED FOR PRIVACY

read error, exit
05/22 12:11:40 [3320] <SendRegistrationRequest:>SMS return=468
05/22 12:11:40 [3320] <ParseHTTPStatusCode:>468=>468 Request not allowed
05/22 12:11:40 [3320] <SendRegistrationRequest:>Content Lenght => 48
05/22 12:11:40 [3320] <mfn_DecodeSSN>Sygate-SSN=25
05/22 12:11:40 [3320] <mfn_DecodeSSN>Read CSN=26
05/22 12:11:40 [3320] HTTP returns status code=468
05/22 12:11:40 [3320] <SendRegistrationRequest:>RECEIVE STAGE COMPLETED
05/22 12:11:40 [3320] <SendRegistrationRequest:>COMPLETED
05/22 12:11:40 [3320] HEARTBEAT: Check Point 5.1
05/22 12:11:40 [3320] <RegHeartbeatProc>switch to another server
05/22 12:11:40 [3320] HEARTBEAT: Check Point 9
05/22 12:11:40 [3320] HEARTBEAT: Check Point 8
05/22 12:11:40 [3320] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
05/22 12:11:40 [3320] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
05/22 12:11:40 [3320] HEARTBEAT: Check Point 1
05/22 12:11:40 [3320] HEARTBEAT: Check Point 2
05/22 12:11:40 [3320] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
05/22 12:11:40 [3320] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
05/22 12:11:40 [3320] HEARTBEAT: Check Point 3
05/22 12:11:40 [3320] <RegHeartbeatProc>Setting the session timeout on Profile Session (Registration) to 30000
05/22 12:11:40 [3320] HEARTBEAT: Check Point 4
05/22 12:11:40 [3320] <RegHeartbeatProc>===Registration STAGE===
05/22 12:11:40 [3320] <MakeRegisterData:>logon id (domain/user)=REMOVED FOR PRIVACY

read error, exit
05/22 12:11:40 [3320] <SendRegistrationRequest:>SMS return=200
05/22 12:11:40 [3320] <ParseHTTPStatusCode:>200=>200 OK
05/22 12:11:40 [3320] <SendRegistrationRequest:>Content Lenght => 350
05/22 12:11:40 [3320] <SendRegistrationRequest:>RECEIVE STAGE COMPLETED
05/22 12:11:40 [3320] <SendRegistrationRequest:>COMPLETED
05/22 12:11:40 [3320] HEARTBEAT: Check Point 5.1
05/22 12:11:40 [3320] <ScheduleNextUpdate>Manually assigned heartbeat=3 seconds
05/22 12:11:40 [3320] <PostEvent>going to post event=EVENT_SERVER_ONLINE
05/22 12:11:40 [3320] <PostEvent>done post event=EVENT_SERVER_ONLINE, return=0
05/22 12:11:40 [3320] HEARTBEAT: Check Point 8
05/22 12:11:40 [3320] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
05/22 12:11:40 [3320] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
05/22 12:11:40 [3320] <RegHeartbeatProc>====== Registration Procedure stops at 12:11:40 ======
05/22 12:11:40 [3320] HEARTBEAT: Check Point 10
05/22 12:11:41 [3320] HEARTBEAT: Check Point Complete
05/22 12:11:41 [3320] <RegHeartbeatProc>Done, Heartbeat=3seconds
05/22 12:11:41 [3320] <CheckHeartbeatTimer>====== Heartbeat loop stops at 12:11:41 ======
05/22 12:11:45 [3320] <CheckHeartbeatTimer>====== Heartbeat loop starts at 12:11:45 ======
05/22 12:11:45 [3320] <GetOnlineNicInfo>:Netport Count=1
05/22 12:11:45 [3320] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="10.0.40.1" Mac="00-1c-25-c1-f5-d3" Gateway="10.0.40.254" SubnetMask="0.0.0.0"/></SSANICs>
05/22 12:11:45 [3320] <CalcAgentHashKey>:CH=51D6C1A40A00080101D0E2D2B07B3E2A1REMOVED FOR PRIVACY280CAE9608EB7161B915A1F6DD9F120B
05/22 12:11:45 [3320] <CalcAgentHashKey>:CHKey=DE8307C107F16B7CE406786959387FC1
05/22 12:11:45 [3320] <CalcAgentHashKey>:C=51D6C1A40A00080101D0E2D2B07B3E2A1REMOVED FOR PRIVACY
05/22 12:11:45 [3320] <CalcAgentHashKey>:CKey=DDF72F96D505903E9B26488AD75F8934
05/22 12:11:45 [3320] <CalcAgentHashKey>:UCH=51D6C1A40A00080101D0E2D2B07B3E2A0REMOVED FOR PRIVACY280CAE9608EB7161B915A1F6DD9F120B
05/22 12:11:45 [3320] <CalcAgentHashKey>:UCHKey=9C247830097733A9B7037A12B5A02857
05/22 12:11:45 [3320] <CalcAgentHashKey>:UC=51D6C1A40A00080101D0E2D2B07B3E2A0REMOVED FOR PRIVACY
05/22 12:11:45 [3320] <CalcAgentHashKey>:UCKey=9E1735C9853BA39AFE8A81D9E64F8091
05/22 12:11:45 [3320] <DoHeartbeat>HardwareID=280CAE9608EB7161B915A1F6DD9F120B
05/22 12:11:45 [3320] <DoHeartbeat>CHKey=DE8307C107F16B7CE406786959387FC1
05/22 12:11:45 [3320] <DoHeartbeat>CKey=DDF72F96D505903E9B26488AD75F8934
05/22 12:11:45 [3320] <DoHeartbeat>UCHKey=9C247830097733A9B7037A12B5A02857
05/22 12:11:45 [3320] <DoHeartbeat>UCKey=9E1735C9853BA39AFE8A81D9E64F8091
05/22 12:11:45 [3320] <DoHeartbeat> Set heartbeat event
05/22 12:11:45 [3320] Use new configuration
05/22 12:11:45 [3320] <CSyLink::IndexHeartbeatProc()>
05/22 12:11:45 [3320] <IndexHeartbeatProc> Got ConfigObject to proceed the operation.. pSylinkConfig: 01B58338
05/22 12:11:45 [3320] <IndexHeartbeatProc>====== Reg Heartbeat loop starts at 12:11:45 ======
05/22 12:11:46 [3320] HEARTBEAT: Check Point 1
05/22 12:11:46 [3320] Get First Server!
05/22 12:11:46 [3320] HEARTBEAT: Check Point 2
05/22 12:11:46 [3320] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
05/22 12:11:46 [3320] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
05/22 12:11:46 [3320] HEARTBEAT: Check Point 3
05/22 12:11:46 [3320] <IndexHeartbeatProc>Setting the session timeout on Profile Session to 30000
05/22 12:11:46 [3320] HEARTBEAT: Check Point 4
05/22 12:11:46 [3320] <IndexHeartbeatProc>===Get Index STAGE===
05/22 12:11:46 [3320] ************CSN=205
05/22 12:11:46 [3320] <mfn_MakeGetIndexUrl:>Request is: action=12&hostid=7C65CD080A000801016F81C125BA0873&chk=DE8307C107F16B7CE406786959387FC1&ck=DDF72F96D505903E9B26488AD75F8934&uchk=9C247830097733A9B7037A12B5A02857&uck=9E1735C9853BA39AFE8A81D9E64F8091&hid=280CAE9608EB7161B915A1F6DD9F120B&groupid=51D6C1A40A00080101D0E2D2B07B3E2A&mode=0&hbt=600&as=205&cn=[hex]505350455253565231&lun=[hex]6A62656E6E657474&udn=[hex]494E5445524E414C2E4348494C44434152452E434F4D2E4155
05/22 12:11:46 [3320] <GetIndexFileRequest:>http://10.0.8.1:80/secars/secars.dll?h=EFF619A1591574A9859B206F63444B91E7B4CB453DE461BF477EDC2E0142C7C30FA094D46B3ECDED200DF8CCEB83FA1D83C0299F0DB900DB5B72DD8672FC22248922865006BF8268104A30141FF9FFC2C36875B7D9E2C4AA7FD715174234A3EA81C8D034E8967211387469346EE1B787A39212ABCE3483E4A5714C27D0AD16F07BC1C06040D054962581C76D648F77198D29F7E64BB651EC831A2EA652083876E0206DE8B3EB8AB2A9165DE6FD57BDFB184D051D57CD56927DC42BFD867545D106F7E0AC285B5B3D07290A4B2DD20BAC6F68799557A5751EFE0B17D2792EF1CBB25EE54D60F30D8AF36B05F112D3A6D350F376156CB2D63246EFAE38D72D446997B00E662B971F42A029A0DFB95412D9195472914771CEF9361BFB7C7842934A8EC0501ACC4E737F692F7D24D6344B8B5A694BC10EDFD0589714589CF2CB104A3A5913F7A56826D027DBB56DB7DC853AE8436B69B888312A1DF226A8482BD260921E7338B5B32497B0050568FF59C6C9C526E1CD4E3E295FB357A960174ED251D88C93929B4D341DF9E8E1A86B87871D35161D097A586F0B1E6ABBACB358C33082D6C621E400FBF748616EE8C48CD68C
05/22 12:11:46 [3320] <GetIndexFileRequest:>SMS return=200
05/22 12:11:46 [3320] <ParseHTTPStatusCode:>200=>200 OK
05/22 12:11:46 [3320] <FindHeader>Sem-HashKey:=>DE8307C107F16B7CE406786959387FC1
05/22 12:11:46 [3320] <FindHeader>Sem-LANSensor:=>0
05/22 12:11:46 [3320] <FindHeader>Sem-Signatue:=>423A82A848FC3AA34F2773A2F05280BDE4C5D016088510E3E84DAECE57D7347EA1F6A6C5EBDE97F9ACBBB94ED2B250DCEC32C0EBED81212E69B6F0EC4F48EDB5871CE31C34425A2AB590E50BCABC21AA1F0FABB46F737F4A49E07EC2A3A11F6269C1C241943E26CBB5A6D9782FC59CCD87840C29DC15A823C375D2462DF661B5
05/22 12:11:46 [3320] <mfn_DoGetIndexFile200>Content Lenght => 1004
05/22 12:11:46 [3320] SignIf::VerifySignature(data, dataLen, sig, sigLen) => Verification Successful..
05/22 12:11:46 [3320] <mfn_DoGetIndexFile200>Index File: <?xml version="1.0" encoding="UTF-8" ?><GroupIndex SiteID="A86002B90A00080100DD9E3E1282C888" ServerID="245672CB0A00080100520C8A612EACAE" GroupID="9225A2E30A000801001CBE19B3136949" GroupCheckSum="842CEA790A323210858413531" LastModifiedTime = "22/05/2009 12:05:27"> <Profile Checksum="124844519BAA8285F6629DA70AAE3A41" SerialNumber="9225-05/21/2009 22:09:36 181" LastModifiedTime="21/05/2009 22:09:44"/> <ConfigFile Checksum="89AC0F1A766881F2251A7ABC8CBDADCC" LastModifiedTime="11/05/2009 15:46:22"/> <IDSFile Checksum="703A0AE1B8EC84B36CDBAECB7E800283" LastModifiedTime="21/05/2009 17:07:58"/> <SylinkFile Checksum="44235D16EEF87F525A60BC750AE491FA" LastModifiedTime="21/05/2009 22:09:44"/> <LSProfile Checksum="7BA3EB2455077262DB26FF97667E6ADD" SerialNumber ="9225-05/21/2009 22:09:36 181" LastModifiedTime ="21/05/2009 22:09:44"/>
<LiveUpdate>
<File Checksum="AC851614882A432603FF6135550BB574" DeltaFlag="1" FullSize="49858267" LastModifiedTime="1242957836164" Moniker="{C60DC234-65F9-4674-94AE-62158EFCA433}" Seq="90521032"/>
<File Checksum="1005CF15DEDFB8C1E3DBD9E4B7A3D9CF" DeltaFlag="1" FullSize="50088617" LastModifiedTime="1242957559075" Moniker="{1CD85198-26C6-4bac-8C72-5D34B025DE35}" Seq="90521032"/>
<File Checksum="BC1252B13F6D70FDB1B323C2381BFE3B" DeltaFlag="1" FullSize="650307" LastModifiedTime="1240983526501" Moniker="{ECCC5006-EF61-4c99-829A-417B6C6AD963}" Seq="2008021700"/>
<File Checksum="6EA314345C7B14B92AB6D2A0906B28C4" DeltaFlag="1" FullSize="669829" LastModifiedTime="1241013318504" Moniker="{C25CEA47-63E5-447b-8D95-C79CAE13FF79}" Seq="80929016"/>
<File Checksum="C0F1FD8BBD607893A4F6A3C2DF5D3A22" DeltaFlag="1" FullSize="412488" LastModifiedTime="1242763844719" Moniker="{E1A6B4FF-6873-4200-B6F6-04C13BF38CF3}" Seq="90519018"/>
<File Checksum="91A159CE021469210B534354EAD9D50F" DeltaFlag="1" FullSize="76805" LastModifiedTime="1242942693371" Moniker="{CC40C428-1830-44ef-B8B2-920A0B761793}" Seq="90521018"/>
<File Checksum="DCF84A2AB944265DD3889AAB7689C40C" DeltaFlag="1" FullSize="413194" LastModifiedTime="1242942702012" Moniker="{812CD25E-1049-4086-9DDD-A4FAE649FBDF}" Seq="90521018"/>
<File Checksum="816E6C190B90B00A319FB950EE01B28D" DeltaFlag="1" FullSize="76793" LastModifiedTime="1242942717449" Moniker="{E5A3EBEE-D580-421e-86DF-54C0B3739522}" Seq="90521018"/>
</LiveUpdate>
</GroupIndex>
05/22 12:11:46 [3320] <mfn_DoGetIndexFile200>Parser Index File!
05/22 12:11:46 [3320] <GetIndexFileRequest:>RECEIVE STAGE COMPLETED
05/22 12:11:46 [3320] <GetIndexFileRequest:>COMPLETED
05/22 12:11:46 [3320] <IndexHeartbeatProc>GetIndexFile handling status: 0
05/22 12:11:46 [3320] <IndexHeartbeatProc>Switch Server flag=0
05/22 12:11:46 [3320] HEARTBEAT: Check Point 5.1
05/22 12:11:46 [3320] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=0
05/22 12:11:47 [3320] <mfn_LiveUpdate:> Agent returned closest matching seq: 90521003
05/22 12:11:47 [3320] <Add2LUFileList:>Adding LU Info to LU Download File List: {C60DC234-65F9-4674-94AE-62158EFCA433}90521032
05/22 12:11:47 [3320] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/22 12:11:47 [3320] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {1CD85198-26C6-4bac-8C72-5D34B025DE35} Seq:90521032
05/22 12:11:47 [3320] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
05/22 12:11:47 [3320] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
05/22 12:11:47 [3320] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/22 12:11:47 [3320] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {E1A6B4FF-6873-4200-B6F6-04C13BF38CF3} Seq:90519018
05/22 12:11:47 [3320] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/22 12:11:47 [3320] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {CC40C428-1830-44ef-B8B2-920A0B761793} Seq:90521018
05/22 12:11:47 [3320] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
05/22 12:11:47 [3320] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
05/22 12:11:47 [3320] <mfn_PrepareLUContent:>Requesting LU Info for : Moniker: {C60DC234-65F9-4674-94AE-62158EFCA433} Target Seq:90521032
05/22 12:11:47 [3320] ************CSN=206
05/22 12:11:47 [3320] <GetContentFileInfoUrl:> Request is: action=52&hostid=7C65CD080A000801016F81C125BA0873&groupid=51D6C1A40A00080101D0E2D2B07B3E2A&fn=[hex]7B43363044433233342D363546392D343637342D393441452D3632313538454643413433337D&cdn=[hex]505350455253565231&lun=[hex]6A62656E6E657474&udn=[hex]494E5445524E414C2E4348494C44434152452E434F4D2E4155&lu=6&luseq=90521003,90520054,81120024,&lulasttriedseq=&lutargetseq=90521032&lucontentstate=0
05/22 12:11:47 [3320] <mfn_RequestLUContentInfo:>URL: /secars/secars.dll?h=F4473C16B200F62C12AC9E58675EBAB3E7B4CB453DE461BF477EDC2E0142C7C30FA094D46B3ECDED200DF8CCEB83FA1D479401CFC28F9D455843F6693D3AD3448CFACF2968B385D64F6BCFAED2143C5DFC3C6E511F29D151BB7A1B6A2200E6536B14B721BB94364D4F50106E078DE9AD068D696567C429BDC19F9ECFA14B2256CECD32CF232C7D11E8BC32ACAC67847A4D62340FAE73FBEF2DC983016D3563D3D7587832AE334A3360FE1C22AA3E9E016F02DACDCAA568902E3C52872BB6E786B778D8D6ACF540845EF9E73D8199B2D904D8028451804D147433D1EA811EEDBC5BF0B7D0CA2E0280D84A8132D91EDE2247EB522F1C8C32E1CD719D1E49422E20BD282B1DC451A7D0904F4A87E25E9A797C976752D5F38FF48C7B6FD5DBB1AEE45FEA9892AAD1628495BF2E7D868C5C2A9231B211A91CB808C06B51AC1550D7CA8FF469AEB6218F0D456A0696D1F74039529643F09092FAB23953DC60C31EF17492ABEAA8B30509576A1DCE7980AE11E2A02A8FA77184291B028403E1C05A946E49318C9E399FA2CF4BE8EEC109D12125
05/22 12:11:47 [3320] <SendUrlAndReceiveResponse:>http://10.0.8.1:80/secars/secars.dll?h=F4473C16B200F62C12AC9E58675EBAB3E7B4CB453DE461BF477EDC2E0142C7C30FA094D46B3ECDED200DF8CCEB83FA1D479401CFC28F9D455843F6693D3AD3448CFACF2968B385D64F6BCFAED2143C5DFC3C6E511F29D151BB7A1B6A2200E6536B14B721BB94364D4F50106E078DE9AD068D696567C429BDC19F9ECFA14B2256CECD32CF232C7D11E8BC32ACAC67847A4D62340FAE73FBEF2DC983016D3563D3D7587832AE334A3360FE1C22AA3E9E016F02DACDCAA568902E3C52872BB6E786B778D8D6ACF540845EF9E73D8199B2D904D8028451804D147433D1EA811EEDBC5BF0B7D0CA2E0280D84A8132D91EDE2247EB522F1C8C32E1CD719D1E49422E20BD282B1DC451A7D0904F4A87E25E9A797C976752D5F38FF48C7B6FD5DBB1AEE45FEA9892AAD1628495BF2E7D868C5C2A9231B211A91CB808C06B51AC1550D7CA8FF469AEB6218F0D456A0696D1F74039529643F09092FAB23953DC60C31EF17492ABEAA8B30509576A1DCE7980AE11E2A02A8FA77184291B028403E1C05A946E49318C9E399FA2CF4BE8EEC109D12125
05/22 12:11:47 [3320] <SendUrlAndReceiveResponse:>SMS return=200
05/22 12:11:47 [3320] <ParseHTTPStatusCode:>200=>200 OK
05/22 12:11:47 [3320] <mfn_RequestLUContentInfo:>Received LU Info : Moniker: {C60DC234-65F9-4674-94AE-62158EFCA433} Target Seq:90521032 Response header: HTTP/1.1 200 OK
Connection: close
Date: Fri, 22 May 2009 02:11:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html
Content-Length:81714
Sem-LUPath: /content/{C60DC234-65F9-4674-94AE-62158EFCA433}/90521032/xdelta90521003.dax
Sem-LUFull: 0
Sem-LUDeltaBaseSeqName: 90521003
Sem-PackageType: 7
Sem-DeltaMethod: 4


05/22 12:11:47 [3320] <FindHeader>Sem-LUFull:=>0
05/22 12:11:47 [3320] <mfn_RequestLUContentInfo:>Sem-LUFull:0
05/22 12:11:47 [3320] <FindHeader>Sem-PackageType:=>7
05/22 12:11:47 [3320] <mfn_RequestLUContentInfo:>Sem-PackageType:7
05/22 12:11:47 [3320] <FindHeader>Sem-DeltaMethod:=>4
05/22 12:11:47 [3320] <FindHeader>Sem-LUDeltaBaseSeqName:=>90521003
05/22 12:11:47 [3320] <FindHeader>Sem-LUPath:=>/content/{C60DC234-65F9-4674-94AE-62158EFCA433}/90521032/xdelta90521003.dax
05/22 12:11:47 [3320] <FindHeader>Content-Length:=>81714
05/22 12:11:47 [3320] <UpdateLUFileList:>Updating existing Download File List with : {C60DC234-65F9-4674-94AE-62158EFCA433}90521032
05/22 12:11:47 [3320] <PostEvent>going to post event=EVENT_SERVER_ONLINE
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_SERVER_ONLINE, return=0
05/22 12:11:47 [3320] <ScheduleNextUpdate>Reset Heartbeat factor index, hearbeat=600 seconds
05/22 12:11:47 [3320] HEARTBEAT: Check Point 6
05/22 12:11:47 [3320] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: AVMan
05/22 12:11:47 [3320] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: LUMan
05/22 12:11:47 [3320] <mfn_PostAgentInfo>===REQUESTING CMC OP-STATE ===
05/22 12:11:47 [3320] <PostEvent>going to post event=EVENT_SERVER_REQUIRES_CLIENT_SESTATE
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_SERVER_REQUIRES_CLIENT_SESTATE, return=0
05/22 12:11:47 [3320] ReasonDescForFailure*** = Host Integrity check is disabled.
05/22 12:11:47 [3320] ReasonDescForFailure*** = Host Integrity check is disabled.
05/22 12:11:47 [3320] *** = <SSAInfo NameSpace="rpc" AgentID="7C65CD080A000801016F81C125BA0873" ComputerID="A0582BF00A000801016F81C1F5078539" HardwareKey="280CAE9608EB7161B915A1F6DD9F120B" GroupID="9225A2E30A000801001CBE19B3136949">
<AgentHIInfo Status="3" ReasonCode="0" ReasonDescForFailure="Host Integrity check is disabled."/>
<SSAHostInfo>
<NetworkIdentity UserDomain="LogonUser="REMOVED FOR PRIVACY" HostDomain="REMOVED FOR PRIVACY" HostName="REMOVED FOR PRIVACY" HostDesc=""/>
<SSAProduct Version="11.0.4000.2295"/>
<SSAOS Version="5.2.3790" Desc="Windows Server 2003 family Standard Edition" Type="50659842" ServicePack="Service Pack 2" Language="9"/>
<Processor ProcessorType="x86 Family 6 Model 15 Stepping 13" ProcessorClock="1596" ProcessorNum="2"/>
<Memory Size="3210739712"/>
<Disk Letter="C:\" Size="80023715840"/>
<BIOS Version="LENOVO - 45"/>
<TpmDevice Id="0"/>
<SSAProfile Version="5.0.0" SerialNumber="9225-05/21/2009 22:09:36 181"/>
<SSAIDS Version="" SerialNumber=""/>
<SSAUTC Bias="-600"/>
<DNSs><DNS Address="10.0.2.1"/><DNS Address="10.0.2.2"/></DNSs>
<SSANICs><SSANIC Ip="10.0.40.1" Mac="00-1c-25-c1-f5-d3" Gateway="10.0.40.254" SubnetMask="0.0.0.0"/></SSANICs><Firewall OnOff="0" Installed="0"/>
</SSAHostInfo>
<RebootRequired Status="0"></RebootRequired>
<InstalledFeatures><Feature Id ="256"/></InstalledFeatures>
</SSAInfo>

05/22 12:11:47 [3320] <mfn_PostAgentInfo>Volatile op-state damper: 0, Interval passed: 1242958307
05/22 12:11:47 [3320] <mfn_PostAgentInfo>Free memory difference: 2705510400, Threshold: 0
05/22 12:11:47 [3320] <mfn_PostAgentInfo>Free disk space difference: 72585555968, Threshold: 0
05/22 12:11:47 [3320] <PostEvent>going to post event=EVENT_SYLINK_QUERY_COMMANDSTATUS
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_SYLINK_QUERY_COMMANDSTATUS, return=0
05/22 12:11:47 [3320] <mfn_PostAgentInfo><?xml version='1.0' encoding='UTF-8' ?>
<SESAgentOpState AgentID="7C65CD080A000801016F81C125BA0873" Timestamp="1242958307327"><TechID Name="AVMan"><Data><![CDATA[<avstate version="1.0"><RTVScanRunning>1</RTVScanRunning><PatternFileRevision>3</PatternFileRevision><UsingPattern>2976259</UsingPattern><PatternFileSequence>0</PatternFileSequence><PatternFileDate>270415000000</PatternFileDate><TimeOfLastVirus>000000000000</TimeOfLastVirus><TimeOfLastScan>000000000000</TimeOfLastScan><WorstInfectionType>9999</WorstInfectionType><OnOff>1</OnOff><SymProtectOnOff>1</SymProtectOnOff><SymSentryInstalled>0</SymSentryInstalled><SavProductVersion>148313068</SavProductVersion><Licensed>0</Licensed><LicenseStatus>0</LicenseStatus><LicenseExpirationTime>000000000000</LicenseExpirationTime><DecAbiVer>1.1.1</DecAbiVer><EraserEngineVer>7143425:61</EraserEngineVer><Moniker Id="{C25CEA47-63E5-447b-8D95-C79CAE13FF79}" Version="1.5.0" Seq="80929016" Owner="SyKnAppS" /><Moniker Id="{E5A3EBEE-D580-421e-86DF-54C0B3739522}" Version="MicroDefsB.CurDefs" Seq="90521018" Owner="SyKnAppS" /><Moniker Id="{812CD25E-1049-4086-9DDD-A4FAE649FBDF}" Version="MicroDefsB.CurDefs" Seq="90521018" Owner="SyKnAppS" /><Moniker Id="{EA960B33-2196-4d53-8AC4-D5043A5B6F9B}" Version="6.1.0" Seq="80820001" Owner="COH" /><Moniker Id="{C13726A9-8DF7-4583-9B39-105B7EBD55E2}" Version="6.1.0" Seq="80820001" Owner="COH" /></avstate>]]></Data></TechID><TechID Name="LUMan"><Data><![CDATA[<lustate><lastUpdateTime>1242602987495052</lastUpdateTime></lustate>]]></Data></TechID><TechID Name="SEP"><Data><![CDATA[<SSAInfo NameSpace="rpc" AgentID="7C65CD080A000801016F81C125BA0873" ComputerID="A0582BF00A000801016F81C1F5078539" HardwareKey="280CAE9608EB7161B915A1F6DD9F120B" GroupID="9225A2E30A000801001CBE19B3136949">
<AgentHIInfo Status="3" ReasonCode="0" ReasonDescForFailure="Host Integrity check is disabled."/>
<SSAHostInfo>
<NetworkIdentity UserDomain="REMOVED FOR PRIVACY" LogonUser="REMOVED FOR PRIVACY" HostDomain="REMOVED FOR PRIVACY" HostName="PSPERSVR1" HostDesc=""/>
<SSAProduct Version="11.0.4000.2295"/>
<SSAOS Version="5.2.3790" Desc="Windows Server 2003 family Standard Edition" Type="50659842" ServicePack="Service Pack 2" Language="9"/>
<Processor ProcessorType="x86 Family 6 Model 15 Stepping 13" ProcessorClock="1596" ProcessorNum="2"/>
<Memory Size="3210739712"/>
<Disk Letter="C:\" Size="80023715840"/>
<BIOS Version="LENOVO - 45"/>
<TpmDevice Id="0"/>
<SSAProfile Version="5.0.0" SerialNumber="9225-05/21/2009 22:09:36 181"/>
<SSAIDS Version="" SerialNumber=""/>
<SSAUTC Bias="-600"/>
<DNSs><DNS Address="10.0.2.1"/><DNS Address="10.0.2.2"/></DNSs>
<SSANICs><SSANIC Ip="10.0.40.1" Mac="00-1c-25-c1-f5-d3" Gateway="10.0.40.254" SubnetMask="0.0.0.0"/></SSANICs><Firewall OnOff="0" Installed="0"/>
</SSAHostInfo>
<RebootRequired Status="0"></RebootRequired>
<InstalledFeatures><Feature Id ="256"/></InstalledFeatures>
</SSAInfo>
]]></Data></TechID><TechID Name="SEP"><Data><![CDATA[<SSAInfo NameSpace="rpc" AgentID="7C65CD080A000801016F81C125BA0873" ComputerID="A0582BF00A000801016F81C1F5078539" HardwareKey="280CAE9608EB7161B915A1F6DD9F120B" GroupID="9225A2E30A000801001CBE19B3136949">
<SSAHostInfo>
<Memory Free="2705510400"/>
<Disk Letter="C:\" Free="72585555968"/>
</SSAHostInfo>
</SSAInfo>
]]></Data></TechID></SESAgentOpState>
05/22 12:11:47 [3320] ************CSN=207
05/22 12:11:47 [3320] <mfn_MakePostUrl:>Request is: action=192&hostid=7C65CD080A000801016F81C125BA0873&chk=DE8307C107F16B7CE406786959387FC1&ck=DDF72F96D505903E9B26488AD75F8934&uchk=9C247830097733A9B7037A12B5A02857&uck=9E1735C9853BA39AFE8A81D9E64F8091&as=207&cn=[hex]505350455253565231&lun=[hex]6A62656E6E657474&udn=[hex]494E5445524E414C2E4348494C44434152452E434F4D2E4155
05/22 12:11:47 [3320] <mfn_PostAgentInfo>http://10.0.8.1:80/secars/secars.dll?h=1324664423EC4F0EC36998D518A55993CBD0D2C6CD9AD97763081DF390CF64D19167677F00B6070244DF54DCCA8F1C20E2B931C54D6A61F6B7043622AB91299553583E531AE970A2807E11C9445B89ECE62C3E3CDCCB61F722DDD1C58FB777FC7354F0EF33242BEF2E2157B4EAFC72E458282928DF9108D44A0633F284EBA36E98256BC73D976ADC1B6A114EDF0BA63CD2CDA5F92E9FB3675B10F76AA777FD4865CA3CC510B7CDF363B71A616A7552370C1C9462F5834BA86474B3DA4D15B930E0D68D39DE30B925E6B21945448ADFDA89B1814A6028078D6C5FF7A69713A578ECE27F257F3976B2A2F82BB9F7336ADCA33B4FAEC702ED1E53F9C69D21700713CCC152BCE5500FF1FEA9291899913B9DB54B33502BDA0D9D2AFA5563316B29F2B602012082625C85DFCCEE6C490DFFCB540AF41E58362519FE0F2FC05E1065AAE8AFD66729471B37D8BB198FEEF85A21
05/22 12:11:47 [3320] <mfn_PostAgentInfo>POST the total size=1476
05/22 12:11:47 [3320] <mfn_PostAgentInfo>Done with return code = 200
05/22 12:11:47 [3320] <IndexHeartbeatProc>===UPLOAD STAGE===
05/22 12:11:47 [3320] <PostEvent>going to post event=EVENT_SERVER_READY_TO_UPLOAD_EVENT_LOG
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_SERVER_READY_TO_UPLOAD_EVENT_LOG, return=0
05/22 12:11:47 [3320] <IndexHeartbeatProc>===PREPARE EVENT LOG STAGE===
05/22 12:11:47 [3320] <PrepareEventLog>initialized technology extension processing ok
05/22 12:11:47 [3320] <PrepareEventLog>Allow total logs to send=0
05/22 12:11:47 [3320] <IndexHeartbeatProc>Communication Mode=1(Pull mode)
05/22 12:11:47 [3320] HEARTBEAT: Check Point 8
05/22 12:11:47 [3320] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
05/22 12:11:47 [3320] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
05/22 12:11:47 [3320] <IndexHeartbeatProc>====== IndexHeartbeat Procedure stops at 12:11:47 ======
05/22 12:11:47 [3320] <IndexHeartbeatProc>Set Heartbeat Result= 2
05/22 12:11:47 [3320] <IndexHeartbeatProc>Sylink Comm.Flags: 'Connection Failed' = 0, 'Using Backup Sylink' = 0, 'Using Location Config' = 0
05/22 12:11:47 [3320] Use new configuration
05/22 12:11:47 [3320] HEARTBEAT: Check Point Complete
05/22 12:11:47 [3320] <IndexHeartbeatProc>Done, Heartbeat=600seconds
05/22 12:11:47 [3320] </CSyLink::IndexHeartbeatProc()>
05/22 12:11:47 [3320] <CheckHeartbeatTimer>====== Heartbeat loop stops at 12:11:47 ======
05/22 12:12:37 [924] SyLinkCreateConfig => Created instance: 01ABC4D8
05/22 12:12:37 [924] Importing ConfigObject: 01B58338 into: 01ABC4D8
05/22 12:12:37 [924] <LUThreadProc> Got ConfigObject to proceed the operation.. pSylinkConfig: 01ABC4D8
05/22 12:12:37 [924] <CRandomDelay::CRandomDelay()>
05/22 12:12:37 [924] Random delay window: 0hour 10min 0sec
05/22 12:12:37 [924] Computed random delay:0hour 5min 16sec 0millisec
05/22 12:12:37 [924] </CRandomDelay::CRandomDelay()>
05/22 12:12:37 [924] <LUThreadProc>Waiting for: 316000 milliseconds to start downloading LU contents
05/22 12:12:37 [3332] <CSyLink::mfn_DownloadNow()>
05/22 12:12:37 [3332] </CSyLink::mfn_DownloadNow()>
05/22 12:13:37 [3332] <CSyLink::mfn_DownloadNow()>
05/22 12:13:37 [3332] </CSyLink::mfn_DownloadNow()>

not a solution, but...
the files in sharedupdates are small for me too. I know my clients are getting updated from the GUP, but the files in sharedupdates are small, less than a meg.

Are you sure your clients are getting their updates from the GUP then?
How can a new client recieve definition updates when the updates arent even in the sharedupdates directory. Im confused, are these minor update files incremental updates? What are they? I have seen package sizes of 45 - 55MB inside the shared updates folders in other implementations of GUPs.

Unless your clients have the ability to update initially from liveupdate (liveupdate.symantecliveupdate.com) which my own definitely do not due to strict bandwidth restrictions (hence my need for a GUP in the first place).

The state office is restricted to internet out only to 10.0.8.1 (http, 8014 and ssl) and their Citrix Server (based at head office)

Is their some invisible restriction on client updates that they cannot get their initial updates from a group update provider?

If the group update provider SEP Client has the latest defs, which is downloads from the management server, why would these updates not be being published to the sharedupdates folder when a fresh client is installed.

Also. Something I didnt write above. I have confirmed my clients and gup has the same policy serial number as listed as the latest on the management server so there is no issue with policy updates. Just not getting any defs.

The debuger.log would be helpful to see how the GUP is communicating.  I did see a couple of things in the log you posted (I'm no expert in this):

<Start>Unable to create Session with 'No Proxies' settings - Error Code: 87   -  Is your proxy settings on the GUP/clients correct?

SubnetMask="0.0.0.0"   - Is this really correct?

I'm also assuming your default gateway is correctly set at 10.0.40.254

It makes no sense how your initial Live Update is working.  You should open a support case with Symantec.  Also, until this is resolved, you might want to implement the setting to bypass the GUP after X hours so your clients get updated from the SEPM.

Another thing to try is disabling one client's firewall and run LU from the client.  This should not be a problem as your clients can telnet to the GUP on port 2967, but let's eliminate it as a possibility.

Also, again just to check, on your LU policy defined for the GUP, what is the cache size defined for the GUP?