Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

GUP download Error

Created: 26 Apr 2013 | 10 comments

I have a Server (Windows 2003 R2 x64) running SEP v12 which doesn't connect to it's local GUP even though it's connected to the SEPM and can communicate with all GUPs on port 2967. Other clients on the same subnet and on other subnets are connecting and updating without any problems.

I'm not too good at interpreting the Sylink log yet, can anyone help me out?

GUPError.PNG

Sylink Log:

04/26 11:00:21.731 [764] Request> http://10.244.161.16:2967/content/{07B590B3-9282-482f-BBAA-6D515D385869}/130425023/xdelta130425009.dax
04/26 11:00:36.966 [6140] <CSyLink::mfn_DownloadNow()>
04/26 11:00:36.966 [6140] </CSyLink::mfn_DownloadNow()>
04/26 11:01:38.998 [6140] <CSyLink::mfn_DownloadNow()>
04/26 11:01:38.998 [6140] </CSyLink::mfn_DownloadNow()>
04/26 11:02:21.734 [764] AH: (InetWaiting) time out. Timeout period: 120000
04/26 11:02:21.734 [764] Throw Internet Exception, Error Code=9;Internet Session Timeout
04/26 11:02:21.734 [764] CInternetException: CHttpConnector::SendRequest: The storage control block address is invalid.
04/26 11:02:21.734 [764] </CHttpConnector::SendRequest()>
04/26 11:02:21.734 [764] </CHttpFileDownload::Do()>
04/26 11:02:21.734 [764] <CHttpFileDownload::~CHttpFileDownload()>
04/26 11:02:21.734 [764] </CHttpFileDownload::~CHttpFileDownload()>
04/26 11:02:21.734 [764] [Content]<LUThreadProc---->to download from GUP with appointed SEPMEMEALONSSS
04/26 11:02:21.734 [764] [Content]<LUThreadProc----> Content update download failed: unexpected error. Moniker: {07B590B3-9282-482f-BBAA-6D515D385869} Target Seq: 130425023 HTTP code: 0
04/26 11:02:21.750 [764] [Content]<LUThreadProc----> Using GUP for updates, try the next GUP in our candidate list for the same content update.
04/26 11:02:21.750 [764] [Content]<LUThreadProc---->Content update downloaded from /content/{07B590B3-9282-482f-BBAA-6D515D385869}/130425023/xdelta130425009.dax to C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\LiveUpdate\LUF{07B590B3-9282-482f-BBAA-6D515D385869}1304250231304250097.TMP, size: 790227
04/26 11:02:21.750 [764] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
04/26 11:02:21.765 [764] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
04/26 11:02:21.765 [764] [Content]<CSyLink::IsContentSpaceAvailable>Sufficient disk space available on C:\ to download content {07B590B3-9282-482f-BBAA-6D515D385869} 130425023
 

Thanks

Operating Systems:

Comments 10 CommentsJump to latest comment

W007's picture

Hello

04/26 11:02:21.734 [764] AH: (InetWaiting) time out. Timeout period: 120000
04/26 11:02:21.734 [764] Throw Internet Exception, Error Code=9;Internet Session Timeout

Did you try again as per log session time out may be cause

Check this artical

Troubleshooting the Group Update Provider (GUP) in Symantec Endpoint Protection (SEP)

http://www.symantec.com/docs/TECH104539

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

Mithun Sanghavi's picture

Hello,

Are you using any proxy (ISA) or firewall or content filter??

This may happen when ISA proxy if installed on the same machine as the GUP with 'web chaining' rules applied on port 80. As a result in this case the upstream proxy was causing a time-out and preventing communications to occur.
 
Solution
 
The upstream proxy should be avoided to allow the GUP to communicate with the SEPM directly as it is not able to cope with long delays and hence times out.
 
Check this Article:

How to create a rule to enable incoming traffic to the Group update provider (GUP) from the Symantec Endpoint Protection Manager (SEPM) wherein Internet Security and Acceleration (ISA) Server 2000 is configured as a public firewall

http://www.symantec.com/docs/TECH104360

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

Chetan Savade's picture

Hi,

If single client (Windows 2003 R2 x64) is affected then problem should be with server itself.

Check definitions are not corrupted.

How to determine if virus definitions of Symantec Endpoint Protection client (SEP) 11 or 12 Small Business Edition, are corrupted

http://www.symantec.com/docs/TECH97677

If definitions are corrupted then follow this article

How to clear out corrupted definitions for a Symantec Endpoint Protection client manually

http://www.symantec.com/docs/TECH103176

Also if possible reboot the server once.
 

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

ClaytonSJ's picture

The client is still updating as I've set my servers to connect directly with liveupdate if their defs go more than a few hours out of date.

Therefore I'm pretty sure the defs are not corrupted.

.Brian's picture

Is the GUP on the same LAN as the clients?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

SebastianZ's picture

Anything filtering the traffic between this Server an local gup?

ClaytonSJ's picture

Thanks for everyones comments.

There is no filtering between the client and the GUP - I've also verified that other machines on the same subnet are connecting to the GUP and updating fine, as are all my other clients on various other subnets.

On the proxy side we don't use ISA however we do a proxy (which is a HA proxy that load balances between 5 Scansafe proxy servers). How will the proxy settings affect the client updating via the GUP? surely that will only affect internet connectivity? As I mentioned earlier the client updates via the internet fine as LiveUpdate is set as a backup.

ClaytonSJ's picture

I'm still confused with this as I'm certain there is no problem with my network setup as all other clients on the same subnet connect without problem and there's no problem with the actual policy or GUPs since they are serving other clients fine.

I would assume the log would give me more information as all I can decipher is:

  • The client recieves the list of GUP's ok
  • The correct GUP in the list is chosen my the client
  • The client sends a request to download the relevant files and then just times out.
  • Only peice of information given in the log for the timeout is: 'The storage control block address is invalid'

What does "The storage control block address is invalid" mean? Tried to Google it and nothing helpful comes up...

This is the relevant peice of the log below:

04/24 22:05:18.525 [764] Request> http://10.244.161.15:2967/content/{810D5A61-809F-49c2-BD75-177F0647D2BA}/130424017/Full.zip
04/24 22:05:26.479 [6140] <CSyLink::mfn_DownloadNow()>
04/24 22:05:26.479 [6140] </CSyLink::mfn_DownloadNow()>
04/24 22:06:28.496 [6140] <CSyLink::mfn_DownloadNow()>
04/24 22:06:28.496 [6140] </CSyLink::mfn_DownloadNow()>
04/24 22:07:18.528 [764] AH: (InetWaiting) time out. Timeout period: 120000
04/24 22:07:18.528 [764] Throw Internet Exception, Error Code=9;Internet Session Timeout
04/24 22:07:18.528 [764] CInternetException: CHttpConnector::SendRequest: The storage control block address is invalid.

Mithun Sanghavi's picture

Hello,

Could you please let us know if the SharedUpdates Folder is mapped to a different drive?

In your case, we would require the entire sylink.log to understand the root cause of the issue - 

Secondly, I would request you to please create a case with Symantec Technical Support.

How to create a new case in MySymantec

http://www.symantec.com/business/support/index?page=content&id=TECH58873

Phone numbers to contact Tech Support:-

Regional Support Telephone Numbers:

  • United States: 800-342-0652 (407-357-7600 from outside the United States)
  • Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
  • United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/business/support/contact_t...

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.