Endpoint Protection

Hi there,

I'm having an issue where my defined GUP will not pull the updates down from the management server. I'm not sure what I'm doing wrong.
There are no firewall issues, both the GUP and the SEP are in the same group showing a green icon.
I've run Sylink Monitor on both the SEP client and GUP, and they both appear to get the same error. It's as though my GUP doesn't know it needs to get the updates from SEPM, rather it trys itself, and then gives up.
Both the GUP and SEP Clients have the relevant registry settings under Symantec Endpoint Protection>Liveupdate, which proves they are getting the Liveupdate policy. The GUP also has the sharedupdates folder.

Here is a snippet from the log, after it has successfully pulled down the latest policies from my SEPM server.

09/16 11:08:50 [4540] <LUThreadProc> Got ConfigObject to proceed the operation.. pSylinkConfig: 01B949A0
09/16 11:08:50 [4540] <LUThreadProc>Starting LU download.
09/16 11:08:50 [4540] <LUThreadProc>Got a valid context from GetCurrentServerEx
09/16 11:08:50 [4540] <LUThreadProc>Setting the session timeout on LUSession to 2 min.
09/16 11:08:50 [4540] <mfn_MakeGetLUFileIISUrl:>Requested Content Path is: /content/{C60DC234-65F9-4674-94AE-62158EFCA433}/90915019/Full.zip
09/16 11:08:50 [4540] <GetLUFileRequest:>IIS URL: /content/{C60DC234-65F9-4674-94AE-62158EFCA433}/90915019/Full.zip
09/16 11:08:50 [4540] <GetLUFileRequest:>http://cpfp01:2967/content/{C60DC234-65F9-4674-94AE-62158EFCA433}/90915019/Full.zip
09/16 11:08:50 [4540] <GetLUFileRequest:>download: C:\Program Files\Symantec\Symantec Endpoint Protection\LiveUpdate\LUF{C60DC234-65F9-4674-94AE-62158EFCA433}909150191.TMP
09/16 11:08:50 [4540] <GetLUFileRequest:>Send Request failed.. Error Code = 12152
09/16 11:08:50 [4540] <ParseErrorCode:>12152=>Unknown error code.
09/16 11:09:43 [6140] <CSyLink::mfn_DownloadNow()>
09/16 11:09:43 [6140] </CSyLink::mfn_DownloadNow()>

Also to note I get a populated GUP.dat under \sharedupdates\
and a 0KB LUF{C60DC234-65F9-4674-94AE-62158EFCA433}909150191.TMP under \liveupdate\
\contentcache\ is empty
(These folders on the GUP)

I can also telnet 2967 to CPFP01 (GUP)

I think you will need to upgarde to MR4 MP2

Check these documents

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009031610185148

 

 

http://service1.symantec.com/support/ent-security.nsf/docid/2009012911000148

Hope this helps you

Please mark a solution to the thread if you get the solution for it:)

 

As noted in my original post, I am running the latest version.

Thanks for your reply

In the sylink log was there any entry for port 2967 is the client try to connect to the GUP server using that port???

From the client.

09/16 13:52:24 [5488] <LUThreadProc>Got a valid context from GetCurrentServerEx
09/16 13:52:24 [5488] <LUThreadProc>Setting the session timeout on LUSession to 2 min.
09/16 13:52:24 [5488] <mfn_MakeGetLUFileIISUrl:>Requested Content Path is: /content/{C60DC234-65F9-4674-94AE-62158EFCA433}/90915019/Full.zip
09/16 13:52:24 [5488] <GetLUFileRequest:>IIS URL: /content/{C60DC234-65F9-4674-94AE-62158EFCA433}/90915019/Full.zip
09/16 13:52:24 [5488] <GetLUFileRequest:>http://192.168.71.1:2967/content/{C60DC234-65F9-4674-94AE-62158EFCA433}/90915019/Full.zip
09/16 13:52:24 [5488] <GetLUFileRequest:>download: C:\Program Files\Symantec AntiVirus\LiveUpdate\LUF{C60DC234-65F9-4674-94AE-62158EFCA433}909150191.TMP
09/16 13:52:24 [5488] <GetLUFileRequest:>HTTP Range header for resuming download: Range: bytes=1376256-55875566
09/16 13:52:24 [5488] <GetLUFileRequest:>Send Request failed.. Error Code = 12152
09/16 13:52:24 [5488] <ParseErrorCode:>12152=>Unknown error code.
09/16 13:52:31 [4016] <CSyLink::mfn_DownloadNow()>
09/16 13:52:31 [4016] </CSyLink::mfn_DownloadNow()>
09/16 13:53:34 [4016] <CSyLink::mfn_DownloadNow()>
09/16 13:53:34 [4016] </CSyLink::mfn_DownloadNow()>
09/16 13:54:24 [5488] <GetLUFileRequest:>ERR to query IIS return code=-9
09/16 13:54:24 [5488] <GetLUFileRequest:>LastError=12152
09/16 13:54:29 [5488] <GetLUFileRequest:>IIS return=0
09/16 13:54:29 [5488] <ParseErrorCode:>12152=>Unknown error code.
09/16 13:54:29 [5488] <GetLUFileRequest:>COMPLETED
09/16 13:54:29 [5488] <LUThreadProc> - GETLUFILE_CONNECTION_ERROR getting content moniker: {C60DC234-65F9-4674-94AE-62158EFCA433}; revision: 90915019 from server: 192.168.71.1
09/16 13:54:29 [5488] LU file download failed due to HTTP error:0


No corrosponding results/log entries relating to this client connect to the gup, in the GUP Debug Window.

on smc -start, I get a lot of these issues.

09/16 13:46:26 [6552] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
09/16 13:46:26 [6552] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
09/16 13:46:26 [6552] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {42B17E5E-4E9D-4157-88CB-966FB4985928} Seq:90911001
09/16 13:46:26 [6552] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
09/16 13:46:26 [6552] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=0
09/16 13:46:26 [6552] <mfn_LiveUpdate:> Agent returned closest matching seq: 90908032
09/16 13:46:26 [6552] <Add2LUFileList:>Adding LU Info to LU Download File List: {C60DC234-65F9-4674-94AE-62158EFCA433}90915019

Hi,

The articles provided by Kavin are relevent to your issue. However, you metioned that you are on MR4MP2 already.

So, you can follow the steps below as a workarund:

limit the number of files stored in \SharedUpdates folder by setting a lower value for "Maximum disk cache size for content updates" or "Delete content update if unused" in policy LiveUpdare > Server Settings > GUP settings.

Let us know if this works for you.

Best,
Aniket

Thank you that seemed to have worked, by limiting it to 300MB rather than the default 500MB. I'm not sure why however, there is plenty of diskspace on the client, and i'm running the latest version.

I'd like to hold more content updates incase mobile users are off the network for more than 3 days, and are still able to get incremental updates.