Endpoint Protection

HI

My SEP GUP is a MS server 2012 r2 std and the GUP status is true in the SEPM. I can telnet to it from the clients it should be updating on 2967 as well.

My SEP clients are 12.1.RU6.MP4 and so is the SEPM.

But the shared updates folder is in bin instead of bin64 as it should be for 64bit clients. Though I can see the .dax files in there.

The clients do not update and there are "malformed request" statements in the log on the client.

The client log also has:

2016/08/29 12:51:38.940 [4204:3100] GUProxy: to set status 1 for 10.1.34.31
2016/08/29 12:51:38.940 [4204:3100] CAsyncHttpConnection::Close - Request: InternetReadFile; CtrlBlk: 04AA7130 time: 0
2016/08/29 12:51:38.940 [4204:3100] SyLinkEventFunc - EVENT_LU_REQUIRE_STATUS: Calling QueryContentSeqData with Moniker: {810D5A61-809F-49c2-BD75-177F0647D2BA} Target Sequence: 160826023
2016/08/29 12:51:38.940 [4204:3100] LuMan: Entering QueryContentSeqData: {810D5A61-809F-49c2-BD75-177F0647D2BA}, 160826023
2016/08/29 12:51:38.956 [4204:3100] LuMan: QueryContentSeqData result: 0x20010006
2016/08/29 12:51:38.956 [4204:3100] LuMan: QueryContentSeqData cached sequence: 160823003
2016/08/29 12:51:38.956 [4204:3100] SyLinkEventFunc - EVENT_LU_REQUIRE_STATUS: QueryContentSeqData returned CMC_CONTENTUPDATE_NEEDED(536936454)
2016/08/29 12:51:38.956 [4204:3100] SyLinkEventFunc - EVENT_LU_REQUIRE_STATUS: No cached content information was returned. Request full package
2016/08/29 12:51:38.956 [4204:3100] GUProxy: Current GUP 10.1.34.31 staus is 1
2016/08/29 12:51:38.956 [4204:3100] GUProxy: GUP 10.1.34.31 chosen

need help troubleshooting why the client won't update and also the sharedupdate location is not as per doc, is that an issue?

by default the GUP size is of 500 MB,can you increase it to 1.5gB and see if that updates the folder? alternatively you can remove it as a gup and enable it again

Go into you GUP configuration and set the 'Maximum disk cache size allowed for downloading updates (MB): to something like 2GB or higher:

These are branch offices and the WAN links are slow, hence we have set the bandwidth limit to 1mbps for the gups, can that create an issue other than delay?

Also how do the gups work when i use the same gup as single gup in different groups and and the subnets of the client and the gup is different.

We have created groups with mixed IP subnets on the SEPM.

Also in 1 group there's only 1 server which is the gup for that group will that then keep looping and asking itself for the content?

some logs I see:

08/29 16:46:58.204 [109432] <GetGupList:>RECEIVE STAGE COMPLETED
08/29 16:46:58.204 [109432] <GetGupList:>COMPLETED
08/29 16:46:58.204 [109432] SyLinkDeleteConfig => Deleting instance: 03FF3278
08/29 16:46:58.204 [109432] <PostEvent> going to post event=EVENT_LU_REQUIRE_STATUS
08/29 16:46:58.235 [109432] <PostEvent> done post event=EVENT_LU_REQUIRE_STATUS, return=0
08/29 16:46:58.235 [109432] [Content]<LUThreadProc>Using GUP to get content update: Moniker: {07B590B3-9282-482f-BBAA-6D515D385869} Target Seq: 160828019 State: 1
08/29 16:46:58.235 [109432] [Content]<LUThreadProc>Retrived GUP for content download.. GUP type: Multiple Group Update Providers last GUP type: Invalid Group Update Provider type
08/29 16:46:58.235 [109432] <SetupTempLUFilePath:>NEW download: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.6867.6400.105\LiveUpdate\LUF{07B590B3-9282-482f-BBAA-6D515D385869}1608280191608150227.TMP
08/29 16:46:58.235 [109432] <InternetCallback> InternetConnect; Internet status: 60; CtrlBlk: 03F259D8
08/29 16:46:58.235 [109432] <CHttpFileDownload::CHttpFileDownload()>
08/29 16:46:58.235 [109432] </CHttpFileDownload::CHttpFileDownload()>
08/29 16:46:58.235 [109432] [Content]<LUDownloader::DownloadFile>  Address: 10.25.248.12 Port: 80 Protocol: 0
08/29 16:46:58.235 [109432] [Content]<LUDownloader::DownloadFile>  Source Path: /content/TempCache/{07B590B3-9282-482f-BBAA-6D515D385869}/160815022/xdelta160815022_To_160828019.dax Target Path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.6867.6400.105\LiveUpdate\LUF{07B590B3-9282-482f-BBAA-6D515D385869}1608280191608150227.TMP Target Size: 11945016
08/29 16:46:58.235 [109432] <CHttpFileDownload::Do()>
08/29 16:46:58.235 [109432] <CHttpFileDownload::getRemainingBytesToDownload()>
08/29 16:46:58.235 [109432] <CHttpFileDownload::getRemainingBytesToDownload> Remaining bytes to download: 11945016
08/29 16:46:58.235 [109432] </CHttpFileDownload::getRemainingBytesToDownload()>
08/29 16:46:58.235 [109432] <CHttpConnector::SendRequest()>
08/29 16:46:58.235 [109432] Request> http://10.160.110.207:2967/content/TempCache/{07B590B3-9282-482f-BBAA-6D515D385869}/160815022/xdelta160815022_To_160828019.dax
08/29 16:46:58.235 [109432] <InternetCallback> HttpOpenRequest; Internet status: 60; CtrlBlk: 03F259D8
08/29 16:47:09.187 [101900] SyLinkDeleteConfig => Deleting instance: 00AA2EC0
08/29 16:47:09.218 [101900] <Stop>Stopping SyLink module...
08/29 16:47:09.249 [108252] <IsToStop:>stopping

As mentioned, shouldn't the sharedupdates folder be in \bin64 as in the documentation. It is in \bin as of now.

And how do the gups work when the client and the gup are in different subnets but connectivity is available with the ports open?