Endpoint Protection

Hello,

Since beginning of August, we saw that SEP12.1 DAILY downloaded/distribued definitions are very big (1.5go instead of the common daily 300-400mo).

It seems that our LUA download full definitions each day !?

We try to uninstall/install LUA again, but it seems to be the same.

Is there any other customer having the same issue ?

The same LUA is downloading an distributing SEP11 definitions, but the DAILY distributed content is OK (about 100-200mo).

It seems to only be attached to SEP12.1 contents...

Nothing has change on our configuration (the same LUA configuration works well on July !).

We are on LuAdmin 2.3.1 (LUA 2.3.1)

We are trying with LUA 2.3.2 (beta) to see if the issue is still here...!

Hi

check this artical.

This is impact for corrupt Virus Definitions from SEPM

How to clear corrupt Virus Definitions from SEPM

https://www-secure.symantec.com/connect/articles/how-clear-corrupt-virus-definitions-sepm

Thank you for your answer, but please read my post. I'm not talking about SEPM...

LIVEUPDATE ADMINISTRATOR (LUA !)

Hello,

By the way please check the components from LUA that you choose,if you choose some content for example with different languages or different versions of SEP that you don't need,it maybe larger.

Regards,

Oykun

Hello,

Only English language is checked.

Here (for informations) are the historical download/distribution of SEP12.1 definitions from LUA 2.3.1. As you will see, everytime a Win32/Win64 updated definition is available, LUA download and distrib the "full" LUA version (=~1.5go)...:/

24   Download SEP12 Download 24/08/12 07:05:52 CEST 24/08/12 07:35:44 CEST Completed 100%

Total size of files in Request:

1 520 813 KB

Request started at :

24/08/12 07:05:52 CEST

Request elapsed time:

29 minute(s),52 seconds

25   Distrib LOCAL SEP12 Distribution 24/08/12 07:35:47 CEST 24/08/12 07:39:23 CEST Completed 100%

Total size of files in Request:

1 520 966 KB

Request started at :

24/08/12 07:35:47 CEST

Request elapsed time:

3 minute(s),36 seconds

31   Download SEP12 Download 24/08/12 12:00:32 CEST 24/08/12 13:03:51 CEST Completed 100%

Total size of files in Request:

1 539 490 KB

Request started at :

24/08/12 12:00:32 CEST

Request elapsed time:

1 hour(s),3 minute(s),19 seconds

36   Distrib LOCAL SEP12 Distribution 24/08/12 13:03:54 CEST 24/08/12 13:08:04 CEST Completed 100%

Total size of files in Request:

1 539 643 KB

Request started at :

24/08/12 13:03:54 CEST

Request elapsed time:

4 minute(s),10 seconds

Hi Ouhlala,

Have you only recently just configured this LUA server to downlaod SEP 12.1 materials, instead of SEP 11?  I might be able to shed some light.  SEP 12.1 downloads more files than SEP 11.  The size increase you see is likely due to the additional daily deltas.  

SEP 12.1 has far more of these daily deltas than SEP 11.  This is very good news for the traffic on the company’s internal network.  (Updates for all SEP clients are smaller/less traffic), but there is the task of getting these extra files down and on to the LUA server and its Distribution Centers. 

Symantec Endpoint Protection 11.x LiveUpdate "Micro Definition" Updates Explained
Article URL http://www.symantec.com/docs/TECH180196

Direct Deltas will be available for the last 15 certified and released virus definitions. Since the advent of the multiple daily LU definitions (on average 3 times daily) this means that on average SEP 11 clients will get Direct Deltas if they have definitions not older than 5 days.

Note that LiveUpdate servers host four weeks worth of daily updates for SEP 12.1 clients.

Examine the filenames in one of the larger-than-usual jobs (these are visible in the LUA GUI for the job in question) and then use the Manage Updates to find out exactly what files are responsible / see what sort of files are making their jobs larger.  Chances are the files are needed, not being downloaded in error somehow.

 How To Determine the Corresponding Product for a LiveUpdate Administrator 2.x File

Additional good LUA information can be found in the article https://www-secure.symantec.com/connect/articles/managing-liveupdate-administrator-2x-space-usage

Hope this helps - Please do keep this thread up to date with your progress!

Hello Mick,

As far as I saw on July 2012 on my LUA server, daily deltas were about 300-400mb, as this KB tell us anyway:

http://www.symantec.com/business/support/index?page=content&id=TECH93409

Best case bandwidth utilization for downloading/distributing a single content type:

NOTE: These are averages based on downloading Antivirus definitions for the Symantec Endpoint Protection (SEP) 12.1 Client for Windows. This is the best case amount of bandwidth each download/distribution for this content type will consume. Multiply this times the amount of distributions when calculating for multiple distribution servers.

As you can see, my LUA server is downloading/distributing 1.5go everytime a virus definitions is available... instead of the 400-440Mb...:(

I think there is something wrong with LUA and SEP12.1...

I have tested this week-end on 3 different servers, with LUA 2.3.1 and the LUA 2.3.2 beta. They both have the same issue, downloading and distributing 1.5go every time...!!

Maybe LiveUpdate Administrator team has an answer ?

Examine the filenames in one of the larger-than-usual jobs (these are visible in the LUA GUI for the job in question) and then use the Manage Updates to find out exactly what files are responsible / see what sort of files are making their jobs larger.  Chances are the files are needed, not being downloaded in error somehow.

 

What were the results?

Revision 2012-08-24 at 7:35 am:

Total= 748050Mo (0.7go)

Revision 2012-08-24 at 1:03pm:

Total = 757373Mo (0.7go)

Total day =~ 1.5go...

don't know what is normally expecting, so I can't compare

And no errors seems to appear somewhere on the LUA GUI :(

A "severity 1" case has been opened for this issue.

Firsts investigations seem to tell us that some "modifications" has been made for the outcoming SEP12 RU2 (Jaguar) on central Symantec Liveupdate servers.

Those modifications are needed to optimize the update definitions incremental size downloaded by SEP12 RU2 Client.

Beside effects: LUA (2.2.x / 2.3.x) is downloading a full HUB (1.5go) each time a new virus definitions is available...! (So for about 2 revisions each day, your LUA will download and distribute 3Go !! Nice...)

Thank you Symantec to made this kind of modifications without any alert to your customers....

Hi Ouhlala,

If your SEPMs can access the Internet source servers, you may wish to use those rather than LUA.  LUA downloads all the files on the Internet source servers and makes them available in the corporate network.  The SEPM has techniques to download only a few files and build / distribute deltas to their clients on the fly.

SEPM and GUP are always better for lower bandwidth: LUA is better for environments that have no internet access, environments where the LU traffic must happen at only a particular time of day, etc.

Hope this helps!

Mick

and LUA is also the only option when you have SAVFL or the SEP for Linux since this client can only get its update from LUA server not through SEPM.

Hello Mick,

If we choose LUA to distribute Symantec definitions over our network (which have 80k computers, 5k servers, distribute on something like 450 differents LAN/WAN...) it's because we got good reasons to do so.

As you already know, SEPM/GUP solutions is something great for little/average company (Even if some improvement will come with the SEP12 Jaguar RU2...) with few LAN and only SEP security solutions.

Also, as John said, you can't distribute definitions from other products with SEPM (we've got SAV10 Linux, SEP11 and SEP12 installed on our computers).

For all those reasons, LUA is the only solutions to made a Liveupdate solutions.

Yes, that does make sense mister Ouhlala :-)

I'm seeing exactly the same issue...  I'm exploring LUA as an alternative to the poor scheduling capability of LU Policy, but seems in this way I can have worst effect than stay as we are... That's somehow sad :(

Hello Mirparx,

We are still investigating issue with Symantec support.

No official conclusion has been made so far...Stay tune !

Hello, all followers of this thread, 

Here is a new article that may be of interest to LUA administrators:

How Big are Current Symantec Endpoint Protection Definitions?
https://www-secure.symantec.com/connect/articles/how-big-are-current-symantec-endpoint-protection-definitions

This one gives an illustration of current total product sizes, what to expect from daily downloads, some best practices to tuning your LUA server.... I've tried to keep it in plain English.  Do be sure to comment with anything that is not clear or needs more details. 

Enjoy! &: )

Hello Mick,

Nice article.

As you seem to be an LUA expert, would you please answer to this simple question:

For SEP12.1, the initial download for 32/64bits SEPC definitions is about =~ 1.5Gb.

Then Delta for each next virus definitions revisions implies a 1.5Gb download/distribution.

Is it ok for you ?

Hi Ouhlala- Many thanks. &: )

Yes, that is correct.  Here's the sizes of the SEP 12.1 download jobs that ran on my LUA server over the weekend:

Total size of files in Request:  1,448,425 KB
Request started at :  07/09/12 16:41:28 IST

Total size of files in Request:  1,430,788 KB
Request started at :  08/09/12 02:40:29 IST

Total size of files in Request:  1,432,360 KB
Request started at :  08/09/12 06:40:28 IST

Total size of files in Request:  1,453,457 KB
Request started at :  09/09/12 00:40:36 IST

Total size of files in Request:  1,469,990 KB
Request started at :  10/09/12 02:40:26 IST

Downloading 1.5 GB is currently the normal/expected size for the SEP 12.1 product. 

Hope this helps!

Mick  

Hello Mick,

It's helping...Yes or No :)

This kind of behavior wasn't excepting before 6th August...Your article is based on the "new LUA behavior".

As far as I'm concerned, my monitoring tools are recording a change on 6th August:

before 6th august, sep12.1 delta definitions were correctly download/distribut for a reasonnable amount of data per revisions (little bit more big than SEP11, but not by a x10)

after 6th august, sep12.1 definitions are acting like you wrote in your article

So main question still remaining, and may never be answered...

(And even if my monitoring tool have a dream about this change, did you find that 1.5go of data/revisions is fine !? seriously...:) )

Hello,

I was wrong in my last post, we finally got an offical answer from Symantec

Liveupdate content publisher team said that they remove the sep12.1 HUB definitions since 08/08/2012.

So, as I said before, the LUA is downloading 1.5go/definitions revisions, but it wasn't like that before...:/

Thank you everyone for your help.

Cheers Ouhlala- I can officially confirm that you are correct.  Documents like the following article have been updated to reflect this.

How Big are Current Symantec Endpoint Protection Definitions?
https://www-secure.symantec.com/connect/articles/how-big-are-current-symantec-endpoint-protection-definitions

 Thanks once again to all for the time and attention invested in this thread! 

Good news Oulalah.

However, do not forget that your SEP clients are not updating directly from your LUA and even not directly from your DC's or SEPM.

What I mean is as you know what an hub def is, there are some situations when the clients do not need it at all and even when they need it, they do not download only the hub defs. So the size of the download can change a lot on daily and weekly basis.

Reminder about the different defs (including the Hub defs) => http://www.symantec.com/business/support/index?page=content&id=TECH180196

The fact that the hub defs have been eliminated for SEP 12.1 permit much more benefits than disadvantages for 90% of our Symantec customers simply because in the most of the situations an LUA solution could be avoided. Of course there is your situation which is somewhat specific because you're downloading SAVFL definitions, thing that a SEPM can't currently do.

Many thanks for your time invested on this very interresting thread. It will probably help some other people who have specific architecture like yours :)

Kind Regards,

A. Wesker