Endpoint Protection

Gup is getting update, whereas the  other clients are not getting update..

Other situation is Gup is not updating whereas clients are getting update...

What will be the issue?

Please provide solutions to resolve this issue.

Please mind that people are more willing to help for free, if one is kind and respects the rules of social interaction.

To help you getting help I would recommend you to think about the following points:

• We don't know your environment. Very much depends on your infrastructure and configuration.
• We are not gifted with a second sight. So please provide a proper description of what your problem is. Answering the following questions will help a lot. 1. What do you want to do? What do you expect to work and in which way should it work? 2. What have you tried to make it work? 3. What are the results of the steps you've tried?
• Kindness.

I hope this will help you to gain help from others for free.

Let's start.

Are you talking about Symantec Endpoint Protection and would "Gup" be a Group Update Provider? In that case this is the wrong section of connect. You can move the topic by clicking on "edit" on the left top of this dicsussion. You will find the Symantec Endpoiint Protection Forum in the Security Section.

Well said Sebaha, if you provide as many details as possible on the issue, it would be easy for others to get a picture on what's going on and suggest some steps that might help to resolve the issue.

This problem is occuring if you have assigned the GUP in wrong Way.

The blow link help to create the GUP

https://www-secure.symantec.com/connect/downloads/create-gup-symantec-can-help-conserve-bandwidth-clients-remote-location

Configuring the Group Update Provider (GUP) in Symantec Endpoint Protection 11.0 RU5
http://www.symantec.com/docs/TECH96419

Gup not working forum

https://www-secure.symantec.com/connect/forums/regarding-gup-0

https://www-secure.symantec.com/connect/forums/gup-not-providing-update-clients-clients-are-able

https://www-secure.symantec.com/connect/forums/i-am-new-symantec-end-point-protectionhelp-me-gup

SEP Content Distribution Monitor (for GUP health-checking)

https://www-secure.symantec.com/connect/downloads/sep-content-distribution-monitor

SEP Content Distribution Monitor - Introduction

https://www-secure.symantec.com/connect/videos/sep-content-distribution-monitor-introduction

Thanks to guiding me how to get help..

The exact situation is.

We are managing nearly 10000 clients in which Antivirus is installed. In a specific state in a specific branch some 20-30 systems are there. In each branch a client system is configured as GUP. In specific branches the clients are not getting updates from the GUP, whereas the GUP is updated. In other branches clients are updating GUP is not updating. So we are manually updating it. This problem is with specific branches. The rest branch the clients getting manual update.

I followed some ways which was suggested to me is as follows…

Checked the content cache folder whether definitions are captured properly.

Clients are able to telnet GUP on port 2967.

GUP version is RU7 or at least RU6MP3.

In our case the GUP version is MR4 MP2.

Now am in need of solution so kindly suggest me.

can you post the sylinklog from one of the client?

Have you checked the GUP Health through the above link.

Hope it help you.

Hi Priya,

Have you check the GUP Health.

I am not able to download that zip file...

I will check soon and will give you the update....

Hi Jack,

Please suggest me how to do which file i have to check

How to check

Suggest me so that i can check and will give you the status early...

Hi Pete,

Which sylink log u need?

Please check whether port 2967 is opened bi-directionally

Regards

Hello Priyaa,

Sylink monitor logs will explain the interaction of  SEP with SEPM and GUP.

Procedure:
START>>RUN>>SMC -STOP

Browse to the following registry location:
HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink
Create a Registry String value named "DumpSylink" and its Data field as "C:\Sylink.log" (location can be changed)

START>>RUN>>SMC -START

Update the policy by right click SEP icon and update policy. Try 3-4 times. Wait for one heart beat to complete.

In the location specified on registry you may find the Sylink.log. Kindly post the same here.

To add: You may try the following link too. In case you want to make you hands dirty.

https://www-secure.symantec.com/connect/forums/sep-update-fails-even-after-telnet-gup-successful

Hi,

Actually with logged a call with symantec so they said that gup be came standarized in RU5.

So we are planning to upgrade the clients version...

Lets see...

And will give you the update soon...

If same issue persist am bound to take ur help..

Thanks &  Regards

Priyaa

Yes, an upgrade to the latest version is definitely recommended. Several issues were fixed

• Using proxy settings for the SYSTEM account
• Only updating definitions when a user is logged in
• and many others

hi,

Is there anything that if we install symantec endpoint protection an unsupported os will give a blue dump error.

Please suggest.

and friends thanks for your support.

Now we have successfully upgraed SEPM to SEP 12.1 RU1 MP1.

will post the updates.

hi,

how the symantec manager console is getting update and how it passing the updates to gup?

HI,

Could you provide.

OS Version ?

HI,

Check this artical

Configuring Group Update Providers in Symantec Endpoint Protection 11.0 RU5

http://www.symantec.com/connect/articles/configuring-group-update-providers-symantec-endpoint-protection-110-ru5

OS version is windows 7 symantec version MR4 MP2.

Nice article ashish...

Is that the same procedure applicable in SEP 12.1 RU1 MP1.

The process is almost the same on 12.RU1MP1

Hi Priyaa,

Did you received your answer ?

Hi manish,

yes I received thanks.

Hi simpson,

Now we have upgraded the symantec manager from 12.1 RU1 MP1 to 12.1 RU2.

The Gup process is totally different so please suggest how to configure the gups.

HI Priyaa,

What is the processing order of an Explicit GUP list within version 12.1.2 of Symantec Endpoint Protection?

http://www.symantec.com/docs/TECH196741

Check this thread also

https://www-secure.symantec.com/connect/forums/how-save-time-entering-multiple-explicit-group-update-providers-gups

Hi Priya,

Please check with below ...

Configuring Group Update Providers in Symantec Endpoint Protection 11.0 RU5

Updated: 23 Sep 2009 | 36 comments

Language Translations

Machine Translations

·         Deutsch

·         Français

·         Español

·         日本語

·         简体中文

Aniket Amdekar

+1919 Votes

Email

inShare

Configuring Multiple GUPs in SEP 11.0 RU5 release, has added a certain dynamics's to the way virus definitions are provided to the clients.

The figure below is a representation of various possibilities of configuring a Group Update Provider:

As shown above, you can either configure a Single GUP or Multiple GUPs in SEPM.

When to use multiple GUPs:

·         You run the latest client software on the computers in your network Multiple Group Update Providers are supported on the computers that run the latest client software. Multiple Group Update Providers are not supported by legacy clients. Legacy clients cannot get content from multiple Group Update Providers. Legacy clients cannot be designated as a Group Update Provider even if they meet the criteria for multiple Group Update Providers. You can create a separate LiveUpdate Settings Policy and configure a single, static Group Update Provider for a group of legacy clients

·         You have multiple groups and want to use different Group Update Providers for each group You can use one policy that specifies rules for the election of multiple Group Update Providers. If clients change locations, you do not have to update the LiveUpdate Settings Policy. The Symantec Endpoint Protection Manager combines multiple Group Update Providers across sites and domains. It makes the list available to all clients in all groups in your network.

·         Multiple Group Update Providers can function as a failover mechanism. Multiple Group Update Providers ensure a higher probability that at least one Group Update Provider is available in each subnet.

Following screenshots will give you a glimpse of how to configure GUPs in RU5:

Here is the screen you see when you go to SEPM Console->Policies->Liveupdate Policy-> Liveupdate Settings Policy-> Server Settings-> Group Update Provider:

·         As we have chose multiple GUPs, we have to provide a GUP List:

·         When you click on Add, you have to specify Rule Criteria:

·         The first option you get is If you want to specify a Computer name or IP Address:

·         The second option is to specify the registry Keys that will define a GUP:

·         Once you choose the main type as the Registry key, you can further specify 3 attribuites :

1. Registry Key :

2. Registry Value:

3. Registry key Name:

The Third option we have is to choose from the Supported Operating Systems for installing SEP 11 RU5.

·         All these rules can be in 1 Rule Set. You can have multiple Rule Sets in your GUP configuration.

Here are some tips to know about the Rule Sets:

Rules are matched based on the logical OR and AND operators as follows:

* Multiple rule sets are OR'ed. A client must match one rule set. This can be useful while roaming across multiple locations. Your client will pass 1 rule set in a location and 2'nd Rule set in a different one, so the IP addresses of GUP will change automatically.

* Multiple rules are AND'ed. A client must match all the rules that are specified in a rule set.

* Multiple values for a rule condition are OR'ed. A client must match one value. For example, you might create RuleSet 1 that includes an IP address rule with several IP addresses. You then create RuleSet2 that includes a host name rule and an operating system rule each with multiple values.A client computer must match either RuleSet1 or RuleSet2.