Endpoint Protection

Hi,

Please refer the attached image for getting a good idea about my scenario. In my SEPM i created a group and configured an update policy to use one of my branch client to act as GUP. And I created an exe for that Group and installed that in all branch machines. But not yet i received any updates from the gup to the clients. when i checked the shared update folder in the gup machine i can see some files there. The size is around 95MB and file is like .........full!zip. Can anybody help me to solve the issue.. My GUP is using 2000 Server OS. Is that create any problem. Nad whwn i checked the SyLink file i saw three entrie s regarding the management server. Two IPs and one system name. That multiple ip makes any problem????

what is the version of SEPM and the GUP and the client machines?

assuming machines are in same subnet range as that of GUP the client will get the updates from GUP.

My GUP is using 2000 Server OS. Is that create any problem.

No, it will not be a problem.

Nad whwn i checked the SyLink file i saw three entrie s regarding the management server. Two IPs and one system name. That multiple ip makes any problem????

No problem again.clients should be able to communicate to SEPM to know the policy that it should take the updates from GUP>

check this URL which should be helpful to troubleshoot further

http://www.symantec.com/business/support/index?page=content&id=TECH104539&locale=en_US

send a sylink logs from the client which is not getting the update

I am using 11.05

thats look good as far GUP working is concerned. Let know if URL is helpful, else post the sylink logs from the client machine which is supposed to get the updates from GUP.

Are you able to get green dot in the GUP and in the other clients?If yes I think it is working correctly and it needs some more time to get the clients updated.Whether this was a new install ?At first install clients will have old updates and it needs full update which is having a large size.Whether the PTP and NTP components of clients got updated?

Hi,

You can use attached doc for further troubleshooting.

Pls make sure GUP and client machines are in same subnet and clients are able to telnet GUP on port 2967 (default).

Attachment(s)

Troubleshooting GUP issues.doc   91 KB 1 version

It could take a while for the GUP to get the delta updates. You can confirm this when you go to the group and see that there is a <defined> GUP under the LiveUpdate to be sure it is configured corrently.

Other than that, you can monitor the network traffic from the server.

Yes i can see the green dot in all clients including but in GUP its an yellow dot. But in SEPM console i can see a green dot in GUP also....all clients are new install. and i installed only antivirus and antispyware protection in all systems except one system. i that system i installed all the components. In that client PTP and NTP updated only the antivirus thing is outdated. I left switched on the GUP overnight for the updation But itz not updated. So is there any way to check the communication process

In my opinion the best way is first do a  manual update in all the clients/deploy the clients with latest update.Here can you confirm that smc.exe is running in 2967 port?

On the GUP, do you see the following directory?

C:\Program Files\Symantec\Symantec Endpoint Protection\SharedUpdates

Just want to make sure that the GUP is properly configured. Firewall restirctions could also be playing a part.

Also, if you need a good network monitor, check out Microsoft Network Monitor:

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=983b941d-06cb-4658-b7f6-3088333d062f&displaylang=en

This might help pinpoint network traffic from the GUP out.

how to do the manual update/deploy clients with update. how can i confirm that smc.exe is running in 2967 port?

"how can i confirm that smc.exe is running in 2967 port?"

In the GUP PC go to command promt and type netstat -a.It will show all the network related processes.Here you can find it

"how to do the manual update/deploy clients with update"

How to deploy the Symantec Endpoint Protection (SEP) client Release Update 5 or later with current virus definitions and intrusion prevention signatures.

For manual update download the fist exe file from this link and run it manually in the client.In the confirmation window click yes..

when i checked the shared update folder in the gup machine i can see some files there. The size is around 95MB and file is like .........full!zip

are these of the latest timestamp?

run the sylink monitor on these machine and post the logs.

Also it would be helpful if run the sepsupport tool and check for the errors and solution to fix it.

which one is good in communication settings the pull mode or push....also the policy inheritance option what settings should i coose keep it on or off

pull is always preffered since there will be less load on the SEPM.

Policy inheritance need to check off in case you do not want the same set of policy on the sub group.

i configured two systems as gup with a rule ip addresses and host names...is that good....

all clients are now updated to the latest version....i removed the gup for some time and clients took the update directly from the sepm....now i reconfigured two systems as GUP with IP address and hostname rule set? and keeping the communication settings as push mode. so now i am waiting for the updation from gup. now i also checked the sharedupdates folder in GUP its empty....if i choose pull mode what should be the heartbeat interval....i will also attaching the sylink file i copied from the gup and from one client.....

Attachment(s)

SyLink_client.xml   6 KB 1 version

SyLink_GUP.xml   6 KB 1 version

That is good.If possible once update all the clients manually with intelligent updater and observe...

Sylink file in both GUP and client will be same.You can use sylink monitor..

Shows only blank white screen

Do you tried this ?

How to confirm if Clients are receiving LiveUpdate content from Group Update Providers (GUPs)

push mode/pullmode???? heartbeat???

did u noticed there are two ips in my sylink file....is that make any problem.....the 192.168.1.111 is the ip usede by the clients to get connected with SEPM and the other for connect to the internet....

pull mode is better i believe...

That should not be a problem.

If you are bothered about those entries you can removing one by creating and assigning new server management list.Refer this KB

Creating and assigning a management server list for a Symantec Endpoint Protection Manager

A couple of things. The GUP and the clients need to be on the same subnet. So, for example if the GUP IP address is 192.168.2.2, the clients need to be 192.168.2.x.

Are the clients on the same subnet?

Secondly, the GUPs use port 2967. Do you have software/hardware firewalls blocking that port? You might need to create an expection.

If you see the shared updates folder on the GUP, that means usually it's setup correctly.

Hi all pls see the attached image.....i configured gup in a branch and when i checked the netstat-a command the gup is listening to the port 2967 itself....it connects to the management server with some other port... and the Shared update folder is still empty

what is the free space available on the GUP ?

the free space is around 1GB

Try to telnet some other clients to this pc on 2967 port .Are you able to do a telnet.You are facing problem with the clients which is present in the same subnet of the GUP,Am I right?

yes both clients and the gup is in same subnet......what will be the problem???

for testing make a 2003 servers as GUP and check

using which port the gup downloads updates from SEPM

we have only one 2003 server which is the SEPM....all branch servers are 2000 Server.....

is it windows 2000 SP4? 

yes..........

8014

Just for testing remove NTP form one of your GUP and observe...

When i try to telnet to the GUP from other PC xxx.xxx.xxx.xxx:2967 but i got a error Could not open a CONNECTION  TO HOST ON PORT 23 :. and the clients are not updated till now...

The telnet command should be like this telnet <IP address of GUP> 2967

NTP and PTP not installed only antivirus and antispyware.........

Thanks it was a syntax error....now i am able to telnet.....whats next i have to check.....PTP and NTP are not installed . only antivirus and antispyware are installed........

Can you get as sylink logs from any of one client.Refer this KB

SylinkWatcher and SylinkMonitor - tools for real-time debugging of SPA 5.x and SEP 11.x

SyLink log attached pls check it....its not taken from the GUP...its from a client in the same subnet

Attachment(s)

sylinklog_1.txt   8 KB 1 version

Delete this client from the SEPM,restart the smc service in the client and try...

Change the server port from 9090 to some other port number which is not in use (e.g. 9091)

check the log file after the said processes

Attachment(s)

sylinklog_2.txt   8 KB 1 version

Still it contains http 500 errors.

Have a look at these KBs

SEP Client not able to communicate with the SEPM server, with HTTP returns status code=500 in SylinkMonitor.log

Client can not communication with server normally ,HTTP returns status code=500

Do you have any proxy setting in the IE of the clients?

If yes remove it and try...

No proxy settings....

Tried this?

u mean gup port or 8014 port????

delete the client from SEP from console and check if it reflects properly

Not both?I mean port 9090 which is used by tomcat in SEPM.

Refer this KB
How to change the port that is used for the Java Remote Console

changed the port to 9091 and after that the client not showed the green dot....i send the command Update Policy from the client and the green dot comes back and i got the attached sylink log after that....pls check it

Attachment(s)

sylinklog_3.txt   8 KB 1 version

sorry....i dont get u...pls make it clear....

when i tried to update the clients directly from SEPM....without GUP its fuctioning properly....the problem is happening only when i choose GUP.......

Do you have IE9 installed on the  GUP machine?

https://www-secure.symantec.com/connect/forums/warning-ie9-beta-causes-sep-client-not-update-virusdefinitions

nope.............all are in IE6

is it now gup updated or u see the yellow exclamation which says about virus defs missing?

still http 500 error.

Create and assign a new management server list which is having only the IP of the LAN card which is used to connect to the network which the client presents.Refer this KB

Creating and assigning a management server list for a Symantec Endpoint Protection Manager

its done already......but no use

Assign some other system in the same subnet as GUP and try...

tried already..........

Same problem with that GUP also?.Pls attach the scm-server-0.log which is present in Program Files \Symantec\Symantec Endpoint Protection Manager\tomcat\logs

there are 2 logs files i found in that folder....attaching both.....pls chk

Attachment(s)

scm-server-0log.txt   1 KB 1 version

scm-server-1log.txt   25 KB 1 version

I think this is the problem

2010-10-14 14:41:59.359 SEVERE: GupListPublishTask->Sempub publish: errBuf =
2010-10-14 14:57:39.562 SEVERE: GupListPublishTask->Sempub publish: errBuf =
2010-10-14 15:59:13.328 SEVERE: GupListPublishTask->Sempub publish: errBuf =

Do a repair for SEPM from add/remove programs...

Repaired SEPM and attaching the logs after repair..........

Attachment(s)

scm-server-0log_0.txt   1 KB 1 version

scm-server-1log_0.txt   1 KB 1 version

And one more thing i for get to say that...my sever datafolder is not located in the same location of SEPM its created in another partition.......want to share that folder....???or need to recreate it in the same partition of sepm

Do you used this method for changing the path?

To change the default location, run the Management Server Configuration Wizard:

1. On the Symantec Endpoint Protection Manager computer, go to All Programs -> Symantec Endpoint Protection Manager -> Management Server Configuration Wizard
2. Select "Reconfigure the management server" and click Next.
3. Leave the Server name, Server port, and Web console port as they are. Change the last field to the location you wish Symantec Endpoint Protection Manager to store the data folder. Click Next.
4. Choose the proper database type for your Symantec Endpoint Protection Manager. Click Next.
5. Fill in the appropriate information to connect to the chosen database type. Click Next.

At this point, the Symantec Endpoint Protection Manager will register this change with the database and begin using the new data folder.

Do a reconfiguration in the SEPM (From management server configuration wizard)and try....

what things i have to reconfigure......???

In the SEPM server go to Programs--->Symantec Endpoint Protection Manager--->Management server configuration wizard ,select reconfigure the server keep all the same old values (If possible I mean if you are having sufficient free space keep the data folder in the installation path).

Have a look at this KB.It is showing the exact errors which is present in your sylink logs

Group Update Providers (GUPs) are not updating their own client defintion content when functioning as a GUP.

how much space should be there for keeping data folder in the same location of the SEPM installation folder