Hi all,

I use a solution that install automatically and sequentially some softwares. I need to know when the SEP 12.1 has ended the installation and has finished to download of the updates so that can start the installation of the next software.

With SEP 11 I was able to wait that the process “luall.exe” goes down, and then I knew when Symantec had finished the installation and the updates download. This process doesn’t exist anymore with SEP 12.1. 

How can I know when the installation is complete (without reading logs)? What check could I make?

Thanks

Aside from confirmation in the logs there isn't much you can view. You can check the client GUI or SEPM for confirmation to verify latest defs are installed by comparing what the SEPM home page shows.

Thanks _Brian,

but the installation must go automatically, without that a person check the client GUI or SEPM for confirmation. I need that a script checks some registry keys/files/other process...  Before I checked with a script that “luall.exe” goes down, but now, with SEP 12.1, I don't know what kind of check I can make

I believe a new ccSvcHst.exe process is started that connects to LU and gets updates. It will be in addition to the ccSvcHst.exe process that is already running.

Virus defs are located here:

C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.4013.4013.105\Data\Definitions\VirusDefs

You can check for latest folder name

Or why don't you just run the symhelp tool remotely, it will tell you. You can push it to the remote machine and have it run silently than collect the data

Monitoring msiexec.exe would be enough I guess. Lu does not initiate any msiexec.exe

or you can monitor the LU event ids from event viewer

Symantec Endpoint Protection 12.1.x event log entries

http://www.symantec.com/business/support/index?page=content&id=TECH186925

I've read that in SEP 12.1 LUALL.exe is been replaced by C:\Program Files\Symantec\Symantec Endpoint Protection\SepLiveUpdate.exe so I've decided to monitor this file, but I don't see the execution of this process after SEP installation and during the download of the updates. Is it normal?

@Refeeq, I've seen you link, but there is not a event related to the definitons update, there is one related to the scheduled download of the definitions...but it isn't the my case.

Thanks

You will only see it run if it's launched manually.