Endpoint Protection

SEP Version:  11.x MR4 (4000)
OS:  Windows Server 2003 R2

For the past 4 days, clients have not been able to download updates from this server.  The client connects fine, just that there's no updates to be installed.

Checking the server, the CPU utilization is at a constant 97-100% due to 3+ postgres.exe processes running that each run at about 20% CPU utilitization.

When looking at the LiveUpdate Adminstrator Event log, it seems that it can't download updates due to a Critical error:
"Failed to obtain write lock on content repository while committing download request id xxxx"

All Windows Updates have been applied and the server has been rebooted twice.  Thought about applying the MP1a patch, but that failed installation.  Ideally, I'd like to hold off upgrading until MP2 is released, so if anyone has an idea how to fix this, I'd really appreciate it.

May I ask you why you need the LiveUpdate Administrator?
It is useless for most of the Symantec Endpoint Protection installations because, simply, the Manager is already a small LiveUpdate Administrator and maybe you can help it with some Group Updates Providers (GUP) that are more efficient and lighter than the LU Administrator.
I hope you did not install the LiveUpdate Administrator in the same machine of the Manager because it is really just a duplication of load in the same machine instead of a load balancing solution.
Anyway there is not relation between the releases of Endpoint Protection and the LiveUpdate Administrator, they are two different products that just cooperate.

Regards,

Well, it was my understanding at the time that I needed it for pull clients. The SEP server has both internal and external clients. Internal are push, with constant communication. External are pull, with scheduled polling.

If LUA is unnecessary for this, I can certainly try pointing my external clients to the Manager instead.

Push mode means, as you wrote, that the clients are constantly connected to the Manager and then they download the definition as soon as they are published by the Manager.
Pull mode means that the clients poll the Manager at a regular time, then the downloading of contents will be on the first heartbeat after the publication of them in the Manager. Usually a heartbeat around 30-60 minutes is good.
Then, you don't need the LiveUpdate Administrator if the clients, in any communication mode, are able to connect to the Manager.
If the clients are not able to connect the Manager then you can allow them to download the definitions from the Symantec's servers instead of managing a LiveUpdate Administrator in your own.
You can use the Location Awareness in this way, for example:

Group: Laptops

Location1: Default (in the company)
Criteria: the client is able to connect to the Manager
LU policy: use the Manager

Location2: Out of the company
Criteria: the client is not able to connect to the Manager
LU policy: use the Symantec's LU servers

depends on how you're setup infrastructure wise. If you have 1 site and are only using SEP from symantec then downloading and distributing via the management console is the best way.

If you have multiple sites and symantec products then a LiveUpdate Administrator is more efficient.

as for the problem:

Which version of LUA are you using ? is it 2.2 or 2.1 , we've had problems with 2.2 not distributing all updates to clients, symantec advised that it was network issues but when I uninstalled 2.2 and put 2.1 back on everything was fine.

I have been asked to give this a try http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/5be4de9c8b16330f802574600038010a?OpenDocument

it may be worthwhile trying it yourself ?

I shut down the LUA services (to fix the CPU utilization problem) and adjusted the policy so that the clients would point at the management server for updates. Worked like a charm.  Thanks much for the suggestions!

Then you can mark this threat as resolved...  ;)

cheers,