Hi,

 

I have a SEPM and different remote sites. In each remote site I have a single GUP, which is up to date with the definitions.

The problem is that certain PCs in some sites are not updating (they were installed 2-3 days ago).

I'm looking in the GUP log and I see some errors - but don't know how to troubleshoot them.

 

Does anyone know what the 2 errors below are representing:

1. GUProxy - Error: FreeCacheEntry called on an entry in use

2. GUProxy - not enough memory for 449107911, ....

 

Thanks a lot.

 

--- ip addresses are edited ---

2014/08/14 15:39:08.049 [3348:1476] GUProxy - Error: FreeCacheEntry called on an entry in use
2014/08/14 15:39:08.049 [3348:1476] GUProxy Freeing incomplete cache entry
2014/08/14 15:39:08.049 [3348:1476] GUProxy - Throttle changed to [0X0000FA00] BPS since Thread Count sub to [0]
2014/08/14 15:39:09.034 [3348:2704] GUProxy: cache file is not on the disk: #content#{07B590B3-9282-482f-BBAA-6D515D385869}#140812023#Full!zip
2014/08/14 15:39:17.221 [3348:644] GUProxy: accepted socket 3792 for 100.2.2.2 port 63149
2014/08/14 15:39:17.221 [3348:4520] GUProxy: Begin to handle accepted socket 3792
2014/08/14 15:39:17.221 [3348:4520] GUPROXY - GUProxy HTTP in - GET /content/{07B590B3-9282-482f-BBAA-6D515D385869}/140812023/Full.zip
2014/08/14 15:39:17.221 [3348:4520] GUPROXY - GUProxy File - /content/{07B590B3-9282-482f-BBAA-6D515D385869}/140812023/Full.zip
2014/08/14 15:39:17.221 [3348:4520] GUPROXY - GUProxy mangled file - #content#{07B590B3-9282-482f-BBAA-6D515D385869}#140812023#Full!zip
2014/08/14 15:39:17.221 [3348:4520] GUProxy - Add request into download queue.
2014/08/14 15:39:17.221 [3348:4104] GUProxy - Throttle changed to [0X0000FA00] BPS since Thread Count added to [1]
2014/08/14 15:39:17.221 [3348:4104] GUPROXY - GUProxy - TARGET_IP: - 100.0.1.1;
2014/08/14 15:39:17.221 [3348:4104] GUProxy - GET SEPM info from SYLINK(1) ,GET /content/{07B590B3-9282-482f-BBAA-6D515D385869}/140812023/Full.zip  BEGIN with 0,total with 0
2014/08/14 15:39:17.237 [3348:4104] GUProxy - not enough memory for 449107911,after geting://100.0.1.1:8014/content/{07B590B3-9282-482f-BBAA-6D515D385869}/140812023/Full.zip

.

What's the exact SEP version of the GUP?

Troubleshooting computer issues with the Symantec Help support tool

Article:HOWTO80839

|

Created: 2012-10-24

|

Updated: 2013-10-07

|

Article URL http://www.symantec.com/docs/HOWTO80839

have you try to clear corrupted definitions ?

How to clear out corrupted definitions for a Symantec Endpoint Protection Client manually:

http://www.symantec.com/docs/TECH103176

Have you verify the client are in same group where policy applied and they can take update from GUP?

As your revert these clients are installed 2-3 days ago so may be it is in default group either offline.

This article can sure you that client take update from GUP

How to confirm if SEP Clients are receiving LiveUpdate content from Group Update Providers (GUPs)

Article:TECH97190

|

Created: 2009-01-03

|

Updated: 2011-08-16

|

Article URL http://www.symantec.com/docs/TECH97190

This article can assist you to check the policy of client and sepm same group. If it can match then it mena client is on the same group

Symantec Endpoint Protection: Troubleshooting Client/Server Connectivity

Article:TECH105894

|

Created: 2008-01-12

|

Updated: 2013-02-08

|

Article URL http://www.symantec.com/docs/TECH105894

Next Step

If both are matched then clean the defintion of SEP client

How to clear out definitions for a Symantec Endpoint Protection 12.1 client manually

Article:HOWTO59193

|

Created: 2011-09-08

|

Updated: 2013-06-24

|

Article URL http://www.symantec.com/docs/HOWTO59193

 

Hi all,

 

Thanks for your help.

@ Brian.

SEP Version of the GUP: 12.1.4100.4126

@ James007

My clients don't have internet access, as far as I can see the tool connects to the internet to chech some versions and stuff ...

I will investigate what it takes to clear the definitions locally.

@ AJ_01

Clients are in the correct group, the correct policy applies to all of them. Sometimes some clients are updated and some not. This is random behavior.

As you can see from my log the clients are connecting to GUP to download the definitions but there are some issues. The tools mentioned in that article seems to be old, I already know the clients are using the GUP.

Clients can  connect to GUP and SEPM, this was verified first. As you can see in the log the connection is being made and there are issues with defitions download.

 

My question still stands. What does this error mean ?

 GUProxy - not enough memory for 449107911

thx.

 

 

 

How many clients receiving update from GUP sever? Do you have space in GUP and client? What version on sepm , GUP , and in sep? The error shows no Space when the client request for full zip. Just one work around Update Sep client with intelligent update. And check The client receive update from GUP after you manualy update.

Possibly it could be due to corrupted defs, try to clear the corrupted defs and give a try.

From the looks of it, the GUP itself has hit the cache limit controlled by the LU Policy when trying to pull down the full 64bit vdefs.

This can quite easily happen if both a 32bit and 64bit client request the full defs, leading to 2 downloads of virus defs which currently site at a little over 400MB each.  With the default cache size set at 500MB, it usually can't handle it.

Have you tried updating the LU policy to increase the GUP cache size?  Obviously, this all depends on the GUP itself having enough free disk space to accommodate the increased cache size and whatnot.