Endpoint Protection Small Business Edition

 View Only
Back to discussions
Expand all | Collapse all

LiveUpdate happening every 6 minutes - degrades server

  • 1.  LiveUpdate happening every 6 minutes - degrades server

    Posted Mar 14, 2011 09:50 AM

    We are seeing that liveupdate kicks in every 6 minutes or so. We know this from the task manager and also from the log below

    I have seen another thread claiming exactly the same symtoms which had no solution.

    Client update policy is to only get updates from server.

    In Admin/Server Properties/LiveUpdate tab the server is set to do live update once a day at 7pm, so why is LiveUpdate kicking in every 6 minutes? When it does kick in performance is severely degraded at clients accessing the server's Borland database. We want to stop this and make LiveUpdate perform only when we have specified.

    Here's a (partial) log...

    March 12, 2011 2:02:10 PM GMT:  Symantec Endpoint Protection Win64 12.0.1001.95 (English) is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:09 PM GMT:  Symantec Endpoint Protection Win32 12.0.1001.95 (English) is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:08 PM GMT:  TruScan proactive threat scan engine Win32 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:07 PM GMT:  TruScan proactive threat scan commercial application list Win32 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:07 PM GMT:  TruScan proactive threat scan whitelist Win64 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:07 PM GMT:  Intrusion Prevention signatures Win64 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:06 PM GMT:  TruScan proactive threat scan engine Win64 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:06 PM GMT:  Submission Control signatures 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:06 PM GMT:  TruScan proactive threat scan data 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:05 PM GMT:  TruScan proactive threat scan whitelist Win32 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:05 PM GMT:  TruScan proactive threat scan commercial application list Win64 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:04 PM GMT:  Virus and spyware definitions Win32 11.0 MicroDefsB.CurDefs is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:04 PM GMT:  Decomposer Win32 and Win64 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:04 PM GMT:  Symantec Protection Center Content Catalog 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:04 PM GMT:  TruScan proactive threat scan commercial application engine 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:03 PM GMT:  Virus and spyware definitions Win64 11.0 MicroDefsB.CurDefs is up-to-date.    [Server: mhserver]
    March 12, 2011 2:02:03 PM GMT:  Intrusion Prevention signatures Win32 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:12 PM GMT:  Symantec Endpoint Protection Win64 12.0.1001.95 (English) is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:11 PM GMT:  Symantec Endpoint Protection Win32 12.0.1001.95 (English) is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:09 PM GMT:  TruScan proactive threat scan engine Win32 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:09 PM GMT:  TruScan proactive threat scan commercial application list Win32 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:09 PM GMT:  TruScan proactive threat scan whitelist Win64 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:08 PM GMT:  Intrusion Prevention signatures Win64 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:08 PM GMT:  TruScan proactive threat scan engine Win64 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:07 PM GMT:  Submission Control signatures 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:07 PM GMT:  TruScan proactive threat scan data 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:07 PM GMT:  TruScan proactive threat scan whitelist Win32 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:06 PM GMT:  TruScan proactive threat scan commercial application list Win64 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:06 PM GMT:  Virus and spyware definitions Win32 11.0 MicroDefsB.CurDefs is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:06 PM GMT:  Decomposer Win32 and Win64 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:05 PM GMT:  Symantec Protection Center Content Catalog 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:05 PM GMT:  TruScan proactive threat scan commercial application engine 11.0 is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:05 PM GMT:  Virus and spyware definitions Win64 11.0 MicroDefsB.CurDefs is up-to-date.    [Server: mhserver]
    March 12, 2011 1:56:04 PM GMT:  Intrusion Prevention signatures Win32 11.0 is up-to-date.    [Server: mhserver] 



  • 2.  RE: LiveUpdate happening every 6 minutes - degrades server

    Posted Mar 14, 2011 11:10 AM

    What OS is this installed on? Has this always been a problem? If not, what changed on this system?

    Was there another Symantec Security product installed on this system in the past?



  • 3.  RE: LiveUpdate happening every 6 minutes - degrades server

    Posted Mar 14, 2011 12:58 PM

    This is SBS2003 standard.

    There is another Symantec product installed (Backup Exec 12.5) but live update is turned off in that package at the moment, at least until this issue is resolved.

    Nothing changed on the system. This has been happening since the original installation a few weeks ago when we replaced SEP 11 with SEP SBE 12 . SEP 11 was fully removed from the server and all clients before replacing with SEP SBE12.



  • 4.  RE: LiveUpdate happening every 6 minutes - degrades server

    Posted Mar 14, 2011 01:08 PM

    there should  be retry interval what is it set to?



  • 5.  RE: LiveUpdate happening every 6 minutes - degrades server

    Posted Mar 14, 2011 01:09 PM

    I see references to both SEP11 and SEP12 in the log. I am not sure if that is the expected behavior here, or maybe there is a remnant of SEP11 still on the system.

    I would open a case with Symantec support for this issue. Lets get the engineers looking into this problem ASAP.

     

    Best,

    Thomas



  • 6.  RE: LiveUpdate happening every 6 minutes - degrades server

    Trusted Advisor
    Posted Mar 14, 2011 01:10 PM

    Hello,

    Did you receive the Email on "Rx4DefsSEP" utility as posted in https://www-secure.symantec.com/connect/forums/liveupdate-and-performance-issues

    This could happen when the Definitions are corrupt.

    Did you try the "Rx4DefsSEP" utility.

    I am Emailing you the Utility.

    Probably that might help you.



  • 7.  RE: LiveUpdate happening every 6 minutes - degrades server

    Posted Mar 14, 2011 01:41 PM

    I already thought of this and I set it to 30 minutes to see if it made a difference - it didn't, updates continue to happen every 6 minutes.



  • 8.  RE: LiveUpdate happening every 6 minutes - degrades server

    Posted Mar 14, 2011 01:44 PM

    I have run the Rx4DefsSEP  utility and it makes no difference - updates are still happening every 6 minutes.



  • 9.  RE: LiveUpdate happening every 6 minutes - degrades server

    Posted Mar 15, 2011 04:55 AM

    Have you tried to run cleanwipe  once, and then reinsdtall liveupdate and SEP client?



  • 10.  RE: LiveUpdate happening every 6 minutes - degrades server
    Best Answer

    Trusted Advisor
    Posted Mar 16, 2011 02:07 PM

    Hello,

    Please Uninstall Symantec Endpoint Protection along with Liveupdate from the machine.

    Delete the following folders of Liveupdate, if they are present:

    On Windows 2000, XP and 2003:

    • C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate
    • C:\Program Files\Symantec\LiveUpdate

      On Windows Vista, 7 and 2008:
    • C:\ProgramData\Symantec\LiveUpdate\
    • C:\Users\All Users\Application Data\Symantec\LiveUpdate

     

    Install SEP again.

     



  • 11.  RE: LiveUpdate happening every 6 minutes - degrades server

    Posted Mar 18, 2011 07:09 AM

    I am going to assume that 'Install SEP again' means to include LiveUpdate.

    When I am next on site I will do this and post the result, though I have to say that I am far from optimistic because I know that a very clean install was done in the first place.



  • 12.  RE: LiveUpdate happening every 6 minutes - degrades server

    Posted Mar 19, 2011 08:10 AM

    Well it has made a difference doing the re-installation.

    The only difference between this instllation and the oiginal is the deletion of the liveupdate folders, so presumably, this is what has made the difference.

    However, although LiveUpdate is now no longer kicking in every 6 minutes, it is still kicking in randomly at unexpected times. When it does kick in however, it finishes very rapidly (so does not degrade the system) and no log entries are created.

    Two points to raise here...

    1) Presumably this is a legacy from either Backup Exec's LiveUpdate or the previous version of SEP (not Small Business as we have now)

    2) If LiveUpdate uninstall had removed the folders in the first place this would not have happened anyway, because I uninstalled all previous SEP and LiveUpdate before installing SEP Small Business.

    Thanks to  Mithun Sanghavi for his solution and to all other contributors too.