Endpoint Protection

I have a workstation here that when looking through the eventviewer the Liveupdate service starts and stops every 30 seconds or so and is slowing down the machine to the point where the user can barely work. We have 50+ machines with the same managed SEP and this is the only one with issues. Anyone have any ideas to help resolve this? Thanks

Are there any error codes generated from this behavior? Can you post the LU log?
It can be found here: C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate

Thomas

i dont know where to look for the error codes. i found Log.LiveUpdate and there is alot of text inside of it. is that the right file? How should i post it? as an attachment? thanks

Does the machine have the latest definitions? Make sure that its connected to SEPM  and has the green dot.

Try to re-deploy the SEP package on that machine and let us know if the issue gets resolved.

Cheers,
Aniket

it has the latest definitions. would re-deploying mean uninstall and reinstall? would that really fix it?

Re-deployment would uninstall the existing client and install a new one.

If the installation is corrupt then it will fix it.

However, if the issue persists then we need to take a look at the flogfile :
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\log.liveupdate

Aniket

ok, i have the log file here already but i may not be able to perform the re-deployment today due the user being busy with administrative duties. do you want me to put up the log file? if so how? thanks

You can open the logfile, do a search for the keyword "error". If you see an error message, you can post 3-4 lines above and below it in your post.

Look for all the errors in the logile, if you see more than one error messge in it, you can post them saperately.

You can create a silent installation package from SEPM, so if the user is busy, he wont notice the installation in the background.
Here is a document for that:

Creating custom Client Installation packages in the Symantec Endpoint Protection Manager Console

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/c741ec26fa674b1e8825738a0076abf3?OpenDocument

How to Deploy Symantec Endpoint Protection to your client computers using the Migration and Deployment Wizard.

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/476542a2b4508f3d8825739300615c98?OpenDocument

Post-install LiveUpdate and Reboot information for Symantec Endpoint Protection

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/cf8f76435a977daf882575230064c4fe?OpenDocument


Cheers,
Aniket

Logs should certainly help us here..

If I understand the HOW? is for log pasting :)

then,

You might want to open the C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\log.liveupdate file in a notepad and then paste it out here


Thanks :)

ok i searched the log file and there was no errors, the only word 'error' that it found was 'no errors'. the only problem that its having is that its starting and stopping very very frequently and uses system resources. ill try to see if we can perform a silent deployment. thanks

What version of SEP are we running ?

The document mentions thart this problem is fixed in Symantec Endpoint Protection 11.0 Maintenance Release 1

Title: 'LiveUpdate Runs Continuously in Symantec Endpoint Protection 11.0'
Document ID: 2007102211424848
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2007102211424848?Open&seg=ent


Thanks :)

how can i check what Maintenance Release it is? All i know is its SEP 11.0 thanks

On the client > Click Help and Support > Version

ON SEPM > Click About (on the right top corner)

This should help...
11.0.1000 = MR1
11.0.2000 = MR2
11.0.3000 = MR3
11.0.4000 = MR4


Thanks :)

great thanks, it says Version: 11.0.1000.1375 so MR1

Gr888 !

We are certain that the upgrade would work in that case... :)

Thanks :)

i havent been able to do the re-deployment, but its the LuCallbackProxy.exe that is taking all the resources and slowing the system down.

Is this happening on all the clients ?

thanks :)

its just on this particular machine. all of the other machines are fine and the original install was nothing out of the ordinary

Could just be a corruption I believe...

Can we try

• Uninstall > Reinstall

OR

• Run Cleanwipe > Reinstall (Would be applicable if the affected machine does not have any other products apart from SEP client and if the machine is not a critical server, as cleanwipe reboots the host twice after running)
   

@ rblumenthal0,

Can you update us when you get a chance?

Thanks,
Thomas