Endpoint Protection

Anybody know how to know the date of pattern file that distribute in the local LiveUpdate server?

I got 2 SEPM getting update from the local LiveUpdate server, both latest virus pattern is 16 August. So I am wondering is LiveUpdate doing its job?

Verify the logs, see what says scheduled update status..

By local liveupdate  server, do you  mean the  Live update  administrator utility? If yes, then, go to LUADMIn-Download and distribute, and look at event viewer. If the  download was successfull after 16th , then it has the definitions after 16th Aug. If you see down distribution successful, after 16th, then the  luadmin has treid to distribute updates to the sepm servers...

For the log in SEPM is just say the pattern is up to date, but for LUA I can see there is new update everyday.

Currently I am manually update the pattern daily.

Is the distribution showing sucessfull in luadmin after 16th aug?

The latest distribution is show Request status : Created and Completed 99 %, because some of it is already presented on the server.

Perhaps I need to clear all the update and redownload every thing?

How do you kniow, some of this is already presented to server?

Below is the log that I get from the LUA


Already present on server Default Production Distribution Center / Default Production Distribution Center Symantec Endpoint Protection v11.0 English SESM Virus Definitions Win32 v11 1282268551jtun_nav2k 

I think you are missing a point? If you go to event  logs, in LU admin, what is the date , when does it show the  last  successful download?( 100%).  Same  for  distribution...

I hope this time I get the correct one

follow this link to know whats latest and what you have :) 

http://www.symantec.com/norton/security_response/definitions.jsp

Could you  please  try a run the  distribution manually once, and see if it completes 100%.... looks like distributiions are not getting  completed...

Probably I will monitor until the next day, because right now both SEPM server is updated manually.

Is there anyway to clear all the pattern that downloaded from Internet in LUA? So it can get the update again and remove the corrupted one.

I tried. SEPM is getting update for TruScan but not virus pattern. Any idea?

OK. Change the  liveupdate  source in sepm, from luadmin to symantec liveupdate  server on internet.  Try  to downlaod the liveupdate  content  from SEPM. Then see, does  sepm, gets  updated or not. If it still does  not, then the  issue, is with SEPM. If it does update this way, then, it is with LUADMIN...

Erm.. it seems like the issue with the LUADMIN then. I change the liveupdate to point to symantec live update server on internet, it works perfectly. But when I change back to local live update server, it does not work that excepted.

I had rerun to download the latest pattern and distribution. In SEPM, it shows LUALL.EXE finished. There where no new content updates. Return code = 1.

In fact, the updates is outdated.

Please help

Try by deleting the updates from download folder and run the manual download in LUA....

I delete the update form the download folder and I run the manual download again. I notice that, when I try to run the manual download for the pattern update, it will show me

There are no new updates available for download that matches request criteria.

Which is your source server ?Is it another LUA?

My Internal LUA is pointing to Internet to get the update.

Once again you double check the proxy settings in the configure tab(configure-->source server--->edit the source server..)

The following Connect Forum Idea (enhancement request) will be of interest to community members participating in this thread:  LiveUpdate Administrator 2.x - Improved Update Management (https://www-secure.symantec.com/connect/idea/liveupdate-administrator-2x-improved-update-management)

If you agree that this proposed enhancement would make troubleshooting easier and improve LUA 2.x server management, please cast your vote to support this idea.  If enough support is given to an idea by the community, the proposed featurs may make their way intoa future release of the product.

Thanks and best regards,

Mick 

Yes, I had confirm that the update source is from liveupdate.symantecliveupdate.com:80

Maybe I need to clear everything like from the database and let the LUA to update again?

I think reinstalling LUA (Hope you double checked your proxy setting in LUA) is the better option here.It will not take much time.

Can you tell us the reason why you are using LUA?

I have multiple SEPM and it will get the update from the LUA.

Please re-install LUADMIN

I decided to reinstall the LUA. I will update the outcome.

HI HunterFighter,

Please do take time to performance tune the newly-installed LUA 2.x server.  Details can be found in LiveUpdate Administrator 2.2 Performance Tuning (http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/822ac074b7bc85a18025763d0079e93b?OpenDocument)

Also of interest: Best Practices for LiveUpdate Administrator (LUA) 2.x (http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/035d65a6c8fccd1b882575970074dfad?OpenDocument)

Please do keep the forum community up-to-date with your progress!

Thanks and best regards,

Mick

1. Open and log into the Symantec Endpoint Protection Manager
2. Click Admin in the left-hand pane
3. Click Servers
4. Highlight Local Site
5. Click Show LiveUpdate Downloads under Tasks

 I had reinstall the LUA and did the performance tuning. I made the changes on the Tomcat properties and I failed to start the services.

The LUA Apache Tomcat service terminated with service-specific error 0 (0x0).

I able to start the services after I remove

-XX:MaxPermSize=40m
-XX:PermSize=40m
-XX:MaxNewSize=64m
-XX:NewSize=64m
-XX:+DisableExplicitGC
-XX:+UseParNewGC

Now whether your SEPM is able to receive updates from LUA?

let us know!

It no close, it still failed. Wondering where goes wrong. 

I reinstalled the LUA, redownload everything and redistribute.  But it still failed.

I run luall in the SEPM, I notice that it just try to download the catalog file, never download the pattern. But if I shift to get the update from internet, it works flawlessly.

From the SEPM console.
- Admin Tab (left)
- View Servers -> Local Site
--> Show Live Update Status
&
--> Download Live Update content.

Should connect to the specified server.

If not in the bottom box, it will give a log.

What, if any, is the Error message (number) you are receiving?

It just give me return code = 1, which is already up to date.

I found out that my clu-prod folder has just minitri.flg file even I distributed the file that I downloaded.

All the download is stored in clu-test, maybe due to my setting as "must test". I changed to "skip test" and manually move the files to clu-prod.

Finally, it solve my problem by reinstalling the LUA.

Thank you guys for helping me.