Endpoint Protection

Hello,

I have an internal liveupdate server which i use to update some clients. This cannot change as update scheduling is needed.

the problem was that all clients using the LU server have not updated recently and they are all stuck on a date at the end of January.

I followed some advice in this thread: https://www-secure.symantec.com/connect/forums/clients-not-updating-internal-liveupdate-server#comment-3642311

I manually ran liveupdate on a client. here is the end of the log:

he digital signature found on the catalog file has been signed by Symantec Corporation.
Processing update list
Opening update list
Processing update list

The following updates have been found:
> Symantec Security Software,  920.1 KB
> Antivirus and antispyware definitions,  1319.2 KB
Total Download 2239.3 KB

Downloading Symantec Security Software (1 of 2), 0% complete...
Downloading Symantec Security Software (2 of 2), 0% complete...
Downloading Antivirus and antispyware definitions (1 of 1), 0% complete...


Installation failed, error summary...
LU1806: LiveUpdate downloaded all of the updates you requested, but all of them failed to install.  Please try to get the updates at a later time.

LiveUpdate session is complete.


I'm assuming this is the problem with the rest of the clients.

anyone have any ideas?

is this windows vista client disable UAC then,
if not try clearing the defs and run the liveupdate again
http://service1.symantec.com/support/ent-security.nsf/docid/2007123111551948 

Its actually a windows 7 client but yes, UAC is disabled.

The clients i am having the issues with are all windows XP clients. I simply gave my computer the same settings to give me somehwere to test. I doubt my definitions are corrupt on the client as if i move back to the SEPM for updates i get updated regularly.

The problem lise with the LU server in my opinion.

is your lu distribution working fine?
You are correct the problem is with liveupdate admin
can you post the liveudpate logs here
you can find that under
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate
attach the log.liveudpate from a failed client.

I checked the machine and didnt see any logs as such.

The files I found were called:

1.Product.Inventory.LiveUpdate
1.Settings.LiveUpdate

I tried uploading these but it wouldnt let me saying they were too large (13kb????)

Any ideas?

only 2 ?
you should have lot of files inside liveudpate folder
check on the working machine
you should have log.liveudpate  
you can open that in text pad.
do u see liveupdate in add / remove programs?
Good article
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009082702000348

Apologies, i overlooked this for some reason. There a lot of files in there, yes.

Did you try uninstall / reinstall of liveudpate as  per this document ?

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008063014422548 

I havent because this is happening on at least 30 computers (each one at a remote site) so i find it hard to beleive that its a corrupt LU installation.

also, my computer has the same problem when i switch it form SEPM updates to LU updates. If i change it back to SEPM i get updates fine.

okay ! is it possible to test this on one client?
I would like to know , if they go through any proxy or firewall as you mentioned your clients are remove..
check this too, are they able to get LU from internet?
http://service1.symantec.com/SUPPORT/sharedtech.nsf/docid/2003090514252213.
 

How many clients having problem,whether most of the client having this problem?Then Try by clearing the virus definitions in SEPM once How to clear corrupt Virus Definitions from SEPM https://www-secure.symantec.com/connect/articles/how-clear-corrupt-virus-definitions-sepm Or most of the clients which is downloading updates from the same GUP? Then clear the shared defs of GUP

Testing on one client is difficult as they are constantly in use with a critical system.

They do not go through any proxy or firewall to get from their location to our internal live update server. Live update direct to the internet is blocked by our firewall so only the SEPM and LU server can download updates form the internet.

I must stress this was working fine for all clients up until the 11th of January. then all clients stopped at the same time.

We have over 30 clients with this same problem. these all use the internal live update server.

I'm not sure why I would clear the definitions fomr the SEPM when the SEPM distribution method works perfectly. Its ONLY liveupdate which has the problem.

sorry I got confused. Wheter most of the clients which is downloading updates from LUA having problem? If yes Can you clear the defs of LUA and try once?

Sorry, I dont understand what you are asking.

Every single client which, through a policy, is told to update fomr the live update server is out of date. All clients show 11th of January as they definition date.

I can clean the definitions out of the LU server but i am unsure as to how to do this correctly. Can anyone provide me with specific instructions on how to go about this?

check this
http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/c09fd96c16c7731b882571560056aeb6 

Sorry, what part of that are you referring to? I dont see any relivant information on there.

well this one just in case.
Specified LiveUpdate Administrator server is not available to the client
The LiveUpdate session can fail for the following reasons:

• Hardware or software stops the client's connection to the LiveUpdate server.
• The client is not configured correctly to connect to the internal LiveUpdate server.
• The LiveUpdate Administrator server is offline.

For directions, read the document How to configure the LiveUpdate Administration Utility. 

I still dont understand how thats relivant. according to the log file the connection was sucessfull, it downloaded updates but the installation failed. To me thats says I have a corrupt file in the live update server repositry. The client then downloads this corrupted file and the installation fails, hence the error message.

as per the doc can we have in interactive mode, to get more info?

By default, LiveUpdate is set to Express Mode for SEP clients. Interactive Mode will yield more information than Express Mode. To change this setting, go to the Windows Control Panels, open Symantec LiveUpdate, and on the General tab, choose the radio button in front of Interactive Mode. Click Apply, then OK.
 
in this mode try to download one small component at a time, check if that succeedes..

Ok I did what you said and here are the results.

I firstly tried to update the virus definitions which it said there was a 1.5mb update. when it tried to update I got this message:

LU1834: LiveUpdate could not find an update file on the server.  Please run LiveUpdate again.

Same happened for intrusion prevention signatures and symantec security software. both these were flagges as having an update found on the internal liveupdate server.

 Try by clearing all updates from download and distribution centers in LUA and freshly download and try.

If not helps reinstall LUA it will not take much time.

How would I do that?

can u try this?
https://www-secure.symantec.com/connect/forums/windows-server-2008-r2-standard-sep-liveupdate-download-contents-dont-apply-updates 

What part of that? I dont see any instructiosn on how to delete and re-download all definition files there.

the last one to make the LU in interactive mode
and then download small bits of lU content...  

The default location of LU download is C:\Documents and Settings\All
Users\Application Data\Symantec\LiveUpdate Administrator\Downloads, C:\Documents and Settings\All
Users\Application Data\Symantec\LiveUpdate Administrator\clu-prod is default distribution center.The temporary download folder will be C:\TempDownload by default.These folders may vary according to the selection you made at the time of installation.Move the files inside these folders to another location and do a manual download and distribution . 

Yes, I have already done that and each component failed to install. It downloaded but didnt install.

What I need to know is how to completly clear the LU server of all updates so it can redownload uncorrupted versions.

its here
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate Administrator\Downloads