Endpoint Protection

Does anyone know where to look on the client as to why the Mac OS X SEP 11.0 RU6 is failing to update content from an internal LiveUpdate server?

We found the logging for LiveUpdate on the MAC client and here it is.  Hoping someone can help steer me in the right direction as to what the issue with my internal LUA server is

May 14, 2010 3:48:44 PM Java LiveUpdate launched with the command line = -c /etc/liveupdate.conf
May 14, 2010 3:48:44 PM Using character set UTF-8
May 14, 2010 3:48:44 PM Command-line Product Selections to update:
May 14, 2010 3:48:44 PM (ProdName, Version, Lang, ItemSeqName, SeqNum)
May 14, 2010 3:48:44 PM Adding JLU to the current command line
May 14, 2010 3:48:44 PM   JLU Macintosh, 3.6, English, LiveUpdateSeq, 20
May 14, 2010 3:48:44 PM Java Version 1.6.0_15.
May 14, 2010 3:48:44 PM Mac OS X 10.6.2
May 14, 2010 3:48:44 PM Java LiveUpdate version 3.6 Build 20.
May 14, 2010 3:48:44 PM ProductInventory: parsed default inventory file: /etc/Product.Catalog.JavaLiveUpdate
May 14, 2010 3:48:44 PM Inventory File Product Selections to update:
May 14, 2010 3:48:44 PM (ProdName, Version, Lang, ItemSeqName, SeqNum)
May 14, 2010 3:48:44 PM The property maxZipFileSize is not set in config file
May 14, 2010 3:48:44 PM The property maxZipFileSize in config file changed to 614,400
May 14, 2010 3:48:44 PM The property maxTriFileSize is not set in config file
May 14, 2010 3:48:44 PM The property maxTriFileSize in config file changed to 10,485,760
May 14, 2010 3:48:44 PM The property maxPackageSize is not set in config file
May 14, 2010 3:48:44 PM The property maxPackageSize in config file changed to 734,003,200
May 14, 2010 3:48:44 PM The property maxPackageContentSize is not set in config file
May 14, 2010 3:48:44 PM The property maxPackageContentSize in config file changed to 734,003,200
May 14, 2010 3:48:44 PM Checking to see if JLU can connect to its own listener thread.
May 14, 2010 3:48:44 PM Checking to see if a session of JLU is running at port 49186.
May 14, 2010 3:48:45 PM An active JLU session has been detected.
May 14, 2010 3:48:45 PM JLU was able to successfully connect to its own listener thread.
May 14, 2010 3:48:45 PM Downloading minitri.flg to /private/tmp/1273866524857/minitri.flg ...
May 14, 2010 3:48:45 PM Connecting to [SERVER NAME]:80 via HTTP ...
May 14, 2010 3:48:45 PM Connected to [SERVER IP] sending request ...
May 14, 2010 3:48:45 PM Waiting for response ...
May 14, 2010 3:48:45 PM Downloading livetri.zip to /private/tmp/1273866524857/livetri.zip ...
May 14, 2010 3:48:45 PM Connecting to [SERVER IP] via HTTP ...
May 14, 2010 3:48:45 PM Connected to [SERVER IP] sending request ...
May 14, 2010 3:48:45 PM Waiting for response ...
May 14, 2010 3:48:45 PM A LiveUpdate server could not be selected.
May 14, 2010 3:48:45 PM
May 14, 2010 3:48:45 PM The Java LiveUpdate session did not complete successfully.
May 14, 2010 3:48:45 PM Return code = -2,001
May 14, 2010 3:48:45 PM

Unfortunately the -2001 error is a pretty generic message.  What sort of machine is hosting the LUA server?   Which version of LUA?  Is it being hosted via IIS?

Might there be a proxy between your Mac and the LUA server?  If so, may want to set exclusions on the client for this LUA address.

If you try to manually navigate to http://[SERVER  NAME (or SERVER IP)]:80/livetri.zip from a browser on the Mac, does it prompt you to download it?

sandra

I have the same problem.

Any resolution

See my post above.  Does your Liveupdate log (/Library/Application Support/Symantec/LiveUpdate/liveupdt.log) resemble the one given above?

sandra

Sorry for the late response Sandra.  The server hosting the LUA is a Windows 2003 Standard build.  There is no proxy in between.  When we try to go directly to the livetri.zip it does prompt to download

No worries. The -2001 basically indicates a failure to connect and download the catalog file from any server.  it could be a communication error; it could be that in the policy, the URL to the directory hosting the definitions is not correct.

Title: '"There was an error performing the update" when running LiveUpdate for Symantec Antivirus for Macintosh'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008110508485848

From the log, "[SERVER NAME]:80" indicates to me you are hosting the definitions via IIS and not the built-in distribution center.  Have you seen this?

Title: '"There was an error performing the update" when running Macintosh LiveUpdate retrieving updates from an IIS server'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009021311350848

To verify the configuration here's this, too:

Title: 'Using the LiveUpdate Administration Utility on a PC to download updates for Symantec AntiVirus 10 for Macintosh clients'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007152728050998

(The information regarding creating a preference set only applies to SAV for Mac, not SEP (which is handled through policy, obviously), but the info regarding the URL to provide the clients is the same.  Will need to update this document...)

sandra

I'll check out the links you provided.  In regards to the other statement, IIS in handling basic web duties for the server and for the LUA, but I created the MAC distribution center the same way I created the SEP11 PC one and the SAV10 PC one.  I attached a screenshot showing the MAC Distribution Center.  Also, am I downloading the correct content for SEP 11 or do I need to change to SAV for MAC?  Let me know if I can provide more in depth info on the MAC DC.  Thanks for all your help.

- Double check that distribution is working (Last connection says "Never")
- Make sure the URL in the policy matches the one in the window above.
- The Macs AV programs use the same defs (NAV/SAV/SEP for Mac), but you may want to double check the available product list for SEP for Mac
- I'd definitely review the IIS doc above for the file types.

sandra

Though unrelated to your current problem, the right content for your Mac is "Symantec Endpoint Protection for Mac Virus Defs". If you dont find this in your LUA's product catalog, then perform an update to the product catalog and you should be seeing this there.

I am having the same problem.  When I run Live Update the client connects to my Live Update Server and then the client tells me everything is up-to-date when it is not.  I can download the livetri.zip file.  However I don't see a livetri file with mac in its name.  Then ones I have are listed as sesm$20virus$20definitions$20win32$20v1_....livetri.zip.  Should there be a Mac version of this file too?

I don't have an LUA installation to refer to directly.  However, Mac definitions have file extensions of .osx and .osi.  You may want to review the document for configuring LUA to host Mac definitions, as well as what's referred above, particularly if LUA is being hosed out of IIS:

Title: 'Using the LiveUpdate Administration Utility on a PC to download updates for Symantec Endpoint Protection/Symantec AntiVirus 10 for Macintosh clients'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007152728050998

Make sure the Mac products are being both downloaded and distributed.  If what the client has is the same or newer than what LUA is offering, then you will see that 'everything is up-to-date' message.

sandra

LUA server is on OSX server and was able to update sep clients until 8/5/10

Log file says no new updates but that is false since 10.2.3 clients are pulling updates.


Sep 9, 2010 3:14:06 PM Checking to see if JLU can connect to its own listener thread.
Sep 9, 2010 3:14:06 PM Checking to see if a session of JLU is running at port 50544.
Sep 9, 2010 3:14:06 PM An active JLU session has been detected.
Sep 9, 2010 3:14:06 PM JLU was able to successfully connect to its own listener thread.
Sep 9, 2010 3:14:06 PM Downloading minitri.flg to /private/tmp/liveupdate/liveupdatehosts/0/url=http:/liveupdate.symantecliveupdate.com:80/1284063245912/minitri.flg ...
Sep 9, 2010 3:14:06 PM Connecting to xxx.xxx.xxxl.xxx:80 via HTTP ...
Sep 9, 2010 3:14:06 PM Connected to 10.228.21.165 sending request ...
Sep 9, 2010 3:14:06 PM Waiting for response ...
Sep 9, 2010 3:14:06 PM Downloading livetri.zip to /private/tmp/liveupdate/liveupdatehosts/0/url=http:/liveupdate.symantecliveupdate.com:80/1284063245912/livetri.zip ...
Sep 9, 2010 3:14:06 PM Connecting to 10.228.21.165 via HTTP ...
Sep 9, 2010 3:14:06 PM Connected to 10.228.21.165 sending request ...
Sep 9, 2010 3:14:06 PM Waiting for response ...
Sep 9, 2010 3:14:06 PM Receiving file ...
Sep 9, 2010 3:14:06 PM Transfer completed in 224 ms (1,215,084 bytes/sec)
Sep 9, 2010 3:14:06 PM The zip entry is liveupdt.tri
Sep 9, 2010 3:14:06 PM The zip entry is liveupdt.grd
Sep 9, 2010 3:14:06 PM The zip entry is liveupdt.sig
Sep 9, 2010 3:14:06 PM Unzipping livetri.zip into /private/tmp/liveupdate/liveupdatehosts/0/url=http:/liveupdate.symantecliveupdate.com:80/1284063245912 ...
Sep 9, 2010 3:14:06 PM The zip file downloaded is a catalog file
Sep 9, 2010 3:14:06 PM Extracting liveupdt.tri
Sep 9, 2010 3:14:06 PM Total number of bytes read is 27,925
Sep 9, 2010 3:14:06 PM Extracting liveupdt.grd
Sep 9, 2010 3:14:06 PM Total number of bytes read is 1,016,935
Sep 9, 2010 3:14:06 PM Extracting liveupdt.sig
Sep 9, 2010 3:14:06 PM Total number of bytes read is 2,267
Sep 9, 2010 3:14:06 PM Unzipping completed
Sep 9, 2010 3:14:06 PM Loading root certificate
Sep 9, 2010 3:14:06 PM Setting certificate restrictions
Sep 9, 2010 3:14:06 PM Loading guard file:  /private/tmp/liveupdate/liveupdatehosts/0/url=http:/liveupdate.symantecliveupdate.com:80/1284063245912/liveupdt.grd
Sep 9, 2010 3:14:06 PM
Sep 9, 2010 3:14:06 PM The Java LiveUpdate session has completed successfully.
Sep 9, 2010 3:14:06 PM Return code = 0
Sep 9, 2010 3:14:06 PM
Sep 9, 2010 3:15:16 PM Java LiveUpdate launched with the command line = -c /Library/Application Support/Symantec/LiveUpdate/liveupdate.conf --abort-on-file-exists /private/tmp/liveupdate.0.LbImKi --available-list /private/tmp/liveupdate.1.rllgZz [ -p Symantec Endpoint Protection for Mac Virus Defs -v MicroDefsB.Full -l SymAllLanguages -z 0 -t IntelVirusDef ] [ -p Symantec Endpoint Protection for Mac Virus Defs -v MicroDefsB.Jul -l SymAllLanguages -z 2010071532 -t IntelVirusDef ] [ -p Symantec Endpoint Protection for Mac Virus Defs -v MicroDefsB.CurDefs -l SymAllLanguages -z 2010080532 -t IntelVirusDef ]
Sep 9, 2010 3:15:16 PM   Symantec Endpoint Protection for Mac Virus Defs, MicroDefsB.Full, SymAllLanguages, IntelVirusDef, 0
Sep 9, 2010 3:15:16 PM   Symantec Endpoint Protection for Mac Virus Defs, MicroDefsB.Jul, SymAllLanguages, IntelVirusDef, 2010071532
Sep 9, 2010 3:15:16 PM   Symantec Endpoint Protection for Mac Virus Defs, MicroDefsB.CurDefs, SymAllLanguages, IntelVirusDef, 2010080532
Sep 9, 2010 3:15:16 PM Using character set UTF-8
Sep 9, 2010 3:15:16 PM Command-line Product Selections to update:
Sep 9, 2010 3:15:16 PM (ProdName, Version, Lang, ItemSeqName, SeqNum)
Sep 9, 2010 3:15:16 PM Adding JLU to the current command line
Sep 9, 2010 3:15:16 PM   JLU Macintosh, 3.6, English, LiveUpdateSeq, 20
Sep 9, 2010 3:15:16 PM Java Version 1.6.0_20.
Sep 9, 2010 3:15:16 PM Mac OS X 10.6.4
Sep 9, 2010 3:15:16 PM Java LiveUpdate version 3.6 Build 20.
Sep 9, 2010 3:15:16 PM ProductInventory: parsed default inventory file: /etc/Product.Catalog.JavaLiveUpdate
Sep 9, 2010 3:15:16 PM Inventory File Product Selections to update:
Sep 9, 2010 3:15:16 PM (ProdName, Version, Lang, ItemSeqName, SeqNum)
Sep 9, 2010 3:15:18 PM The property maxZipFileSize in config file is 614,400
Sep 9, 2010 3:15:18 PM The property maxTriFileSize in config file is 10,485,760
Sep 9, 2010 3:15:18 PM The property maxPackageSize in config file is 734,003,200
Sep 9, 2010 3:15:18 PM The property maxPackageContentSize in config file is 734,003,200
Sep 9, 2010 3:15:18 PM Cache is disabled.
Sep 9, 2010 3:15:18 PM Checking to see if JLU can connect to its own listener thread.
Sep 9, 2010 3:15:18 PM Checking to see if a session of JLU is running at port 50605.
Sep 9, 2010 3:15:18 PM An active JLU session has been detected.
Sep 9, 2010 3:15:18 PM JLU was able to successfully connect to its own listener thread.
Sep 9, 2010 3:15:18 PM Downloading minitri.flg to /private/tmp/liveupdate/liveupdatehosts/0/url=http:/liveupdate.symantecliveupdate.com:80/1284063318406/minitri.flg ...
Sep 9, 2010 3:15:19 PM Connecting to macavconsole.stp.mrll.com:80 via HTTP ...
Sep 9, 2010 3:15:19 PM Connected to 10.228.21.165 sending request ...
Sep 9, 2010 3:15:19 PM Waiting for response ...
Sep 9, 2010 3:15:19 PM Downloading livetri.zip to /private/tmp/liveupdate/liveupdatehosts/0/url=http:/liveupdate.symantecliveupdate.com:80/1284063318406/livetri.zip ...
Sep 9, 2010 3:15:19 PM Connecting to 10.228.21.165 via HTTP ...
Sep 9, 2010 3:15:19 PM Connected to 10.228.21.165 sending request ...
Sep 9, 2010 3:15:19 PM Waiting for response ...
Sep 9, 2010 3:15:19 PM Receiving file ...
Sep 9, 2010 3:15:19 PM Transfer completed in 224 ms (1,215,084 bytes/sec)
Sep 9, 2010 3:15:19 PM The zip entry is liveupdt.tri
Sep 9, 2010 3:15:19 PM The zip entry is liveupdt.grd
Sep 9, 2010 3:15:19 PM The zip entry is liveupdt.sig
Sep 9, 2010 3:15:19 PM Unzipping livetri.zip into /private/tmp/liveupdate/liveupdatehosts/0/url=http:/liveupdate.symantecliveupdate.com:80/1284063318406 ...
Sep 9, 2010 3:15:19 PM The zip file downloaded is a catalog file
Sep 9, 2010 3:15:19 PM Extracting liveupdt.tri
Sep 9, 2010 3:15:19 PM Total number of bytes read is 27,925
Sep 9, 2010 3:15:19 PM Extracting liveupdt.grd
Sep 9, 2010 3:15:19 PM Total number of bytes read is 1,016,935
Sep 9, 2010 3:15:19 PM Extracting liveupdt.sig
Sep 9, 2010 3:15:19 PM Total number of bytes read is 2,267
Sep 9, 2010 3:15:19 PM Unzipping completed
Sep 9, 2010 3:15:19 PM Loading root certificate
Sep 9, 2010 3:15:19 PM Setting certificate restrictions
Sep 9, 2010 3:15:19 PM Loading guard file:  /private/tmp/liveupdate/liveupdatehosts/0/url=http:/liveupdate.symantecliveupdate.com:80/1284063318406/liveupdt.grd
Sep 9, 2010 3:15:20 PM
Sep 9, 2010 3:15:20 PM The Java LiveUpdate session has completed successfully.
Sep 9, 2010 3:15:20 PM Return code = 0
Sep 9, 2010 3:15:20 PM

Also there appears to be no way of adding a secondary server into the conf files when controlled by SEPM Server and policies.  This is a problem for mobile mac users who may be off line for a time. 

SAV Mac definitions and SEP Mac definitions have two different product designations.  Double check on LUA that this content is also being downloaded.  The lua-application.log* should have some hints as to what's happening.  These can be collected by the debug.do command.  See the following:

Title: 'How to Collect Troubleshooting Information from LiveUpdate Administrator 2.x'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009030211283748

Also there appears to be no way of adding a secondary server into the conf files when controlled by SEPM Server and policies.  This is a problem for mobile mac users who may be off line for a time.

This is (unfortunately) correct because a heartbeat into the SEPM would change the conf file back to the policy setting, and location switching is not possible for Macs.  You might be able to create an entry for a second "internal LiveUpdate server" and point it back to the Symantec server (via http, liveupdate.symantec.com and liveupdate.symantecliveupdate.com) so that when failure to the true internal site occurs, it should pass to the next on the list.  I haven't tested this directly myself, but the policy is really only asking for a URL, no indication this is restricted to internal addresses.  No credentials are needed for Symantec's servers.

I would suggest submitting an Idea here on the forum to request failover for Internal LUA to Symantec LiveUpdate Servers or Mac location awareness, officially.

sandra

Sorry that directory does not exist and the documentation from your site says to pull the norton av intel updates for mac sep 11.  I do this AND up until august 5 this worked correctly. 

here is my lua log

 

Download Session:   2010-09-09 13:59:24
2010-09-09 13:59:24 Running DownloadLiveUpdatePackages 2.1.1 to retrieve updates
2010-09-09 13:59:32 Running InstallLiveUpdateAdmin.command 2.1.1
2010-09-09 13:59:38 OS X version: 10.5.8
2010-09-09 13:59:40 Proxy server login password has not been entered.
2010-09-09 13:59:40 Will attempt to use FTP proxy server squid.icrp.mrll.com:3128 as anonymous user.
2010-09-09 13:59:40 Checking for a new version of LiveUpdate Administration Utility at:
2010-09-09 13:59:41    ftp://update.symantec.com
2010-09-09 13:59:41 Using curl to download file
2010-09-09 13:59:43 There is no newer version of LiveUpdate Administration Utility at this time.
2010-09-09 13:59:44 Contents of preference file:
ConfHostURL=ftp://stp1map06v.stp.mrll.com
ConfLoginName=sacmftp
ConfLoginPassword=K&9a9qUx4%k8*$%2v^n9-0f$%a9qp1@a%5a9q$%a9qZ32@74p^a9qp#fwta9qn(952cv+a9q91pfoo%bga9q8z#vY=+a9qaW#@vuyed9a9q12bS0egd$vmeqa9qH2efsdwca9q*seCsbutdwesw9&fwa9qa01tFqv
ConfLoginPasswordLength=7
DoBackupPreviousDownload=TRUE
DoCheckForNewVersionOfAdminUtility=TRUE
DoDownloadFromHTTPservers=FALSE
DoDownloadOnlyNewUpdates=TRUE
DoRemoveUnselectedProductsFromTriFile=FALSE
DoRemoveUnusedFiles=TRUE
DoShowHelpMessage=TRUE
DoUseActiveModeFTP=FALSE
DoUseFTPproxyServer=TRUE
DownloadArchiveFolder=/Applications/LiveUpdateAdminUtility/Retrieved Updates Archives
DownloadFolder=/Library/WebServer/Documents/avupdates
ExtraMBneeded=1024
FTPproxyServer=squid.icrp.mrll.com:3128
FTPproxyServerRequiresPassword=FALSE
LanguageToUpdate=English
MaximumLinesInLog=100000
NumberOfBackupArchives=200
NumberOfDownloadRetries=5
PreviousDownloadArchiveFolder=/Applications/LiveUpdateAdminUtility/Retrieved Updates Archives
PriorLanguage=English
PriorLanguage=SymAllLanguages
ProductToUpdate=All AntiVirus
SchedulePromptWasShown=TRUE
TriFileUpdatedForSpecialVersion=TRUE
2010-09-09 13:59:44 OS X version: 10.5.8
2010-09-09 13:59:46 Proxy server login password has not been entered.
2010-09-09 13:59:46 Will attempt to use FTP proxy server squid.icrp.mrll.com:3128 as anonymous user.
2010-09-09 13:59:47 Determining if there is enough disk space to start download to
2010-09-09 13:59:47 "/Library/WebServer/Documents/avupdates"
2010-09-09 13:59:47 Space needed (MB rounded up): 50 MB (51,200 KB)
2010-09-09 13:59:48 Space available (MB rounded down): 2,782 MB (2,849,092 KB)
2010-09-09 13:59:48 There appears to be enough free disk space.
2010-09-09 13:59:48 Downloading livetri.zip from ftp://update.symantec.com
2010-09-09 13:59:49 Using curl to download file
2010-09-09 13:59:52 NOTE: Files will be downloaded from: ftp://update.symantec.com
2010-09-09 13:59:52 Extracting liveupdt.tri
2010-09-09 13:59:52 Searching liveupdt.tri for Macintosh updates - this may take a minute
2010-09-09 14:00:39 Adding file to download queue: 1284020663jtun_enncurd2.osi (67947 KB)
2010-09-09 14:00:41 Adding file to download queue: 1284020663jtun_enncurd2.osx (67964 KB)
2010-09-09 14:05:07 Finished search.
2010-09-09 14:05:07 Free disk space needed for download: 133 MB for updates + 1024 MB reserve space
2010-09-09 14:05:08 Determining if there is enough disk space to download packages to
2010-09-09 14:05:09 "/Library/WebServer/Documents/avupdates"
2010-09-09 14:05:10 Space needed (MB rounded up): 1,157 MB (1,184,487 KB)
2010-09-09 14:05:12 Space available (MB rounded down): 2,779 MB (2,845,772 KB)
2010-09-09 14:05:12 There appears to be enough free disk space.
2010-09-09 14:05:12 Beginning download of 2 files
2010-09-09 14:05:12 Downloading 1 of 2: 1284020663jtun_enncurd2.osi
2010-09-09 14:05:15 Retrieving information about file from server
2010-09-09 14:05:16 Using curl to download file
2010-09-09 14:06:59 Downloading 2 of 2: 1284020663jtun_enncurd2.osx
2010-09-09 14:07:01 Retrieving information about file from server
2010-09-09 14:07:02 Using curl to download file
2010-09-09 14:08:44 Determining if there is enough disk space to archive previous download session to
2010-09-09 14:08:44 "/Applications/LiveUpdateAdminUtility/Retrieved Updates Archives"
2010-09-09 14:08:46 Space needed (MB rounded up): 3,028 MB (3,099,776 KB)
2010-09-09 14:08:48 Space available (MB rounded down): 2,643 MB (2,707,004 KB)
2010-09-09 14:08:49 Files in archive folder take up 6,151,444 KB.
2010-09-09 14:08:51 Deleting archive folder to make space for new archive:
2010-09-09 14:08:51 "/Applications/LiveUpdateAdminUtility/Retrieved Updates Archives/2010-09-03_19.36.10"
2010-09-09 14:08:53 Space available (MB rounded down): 4,645 MB (4,757,032 KB)
2010-09-09 14:08:53 There appears to be enough free disk space.
2010-09-09 14:08:53 Archiving previous download set to:
2010-09-09 14:08:53 "/Applications/LiveUpdateAdminUtility/Retrieved Updates Archives/2010-09-09_00.14.46"
2010-09-09 14:11:44 Removing unnecessary entries from TRI file - this may take a while
2010-09-09 14:13:50 Looking for previously downloaded files that are no longer in use
2010-09-09 14:13:51 Looking for files that are not in the TRI file
2010-09-09 14:13:53 Deleting file that is not in the TRI file: 1283932366jtun_enncurd2.osx
2010-09-09 14:13:54 Deleting file that is not in the TRI file: 1283932366jtun_enncurd2.osi
2010-09-09 14:13:55 Updates were successfully downloaded into download folder:
2010-09-09 14:13:55 "/Library/WebServer/Documents/avupdates"
2010-09-09 14:13:55 Files in download folder:
DownloadSession.log
Groups
Public
Users
livetri.zip
1145316230jtun_alu303a.osx
1173381680jtun_alu350.osx
1194502800jtun_alu404a.osx
1203717431jtun_asa1011.osx
1122653960jtun_elu303.osx
1194503020jtun_elu404.osx
1240251817jtun_elu502.osx
1166560288jtun_ena1012.osx
1122653960jtun_ena903.osx
1129750508jtun_ena904a.osx
1282335303jtun_enn01md2.osi
1282335303jtun_enn01md2.osx
1282335303jtun_enn02md2.osi
1282335303jtun_enn02md2.osx
1282335303jtun_enn03md2.osi
1282335303jtun_enn03md2.osx
1282335303jtun_enn04md2.osi
1282335303jtun_enn04md2.osx
1282335303jtun_enn05md2.osi
1282335303jtun_enn05md2.osx
1282335303jtun_enn06md2.osi
1282335303jtun_enn06md2.osx
1282335303jtun_enn07md2.osi
1282335303jtun_enn07md2.osx
1282335303jtun_enn08md2.osi
1282335303jtun_enn08md2.osx
1282335303jtun_enn09md2.osi
1282335303jtun_enn09md2.osx
1282335303jtun_enn10md2.osi
1282335303jtun_enn10md2.osx
1282335303jtun_enn11md2.osi
1282335303jtun_enn11md2.osx
1282335303jtun_enn12md2.osi
1282335303jtun_enn12md2.osx
1284020663jtun_enncurd2.osi
1284020663jtun_enncurd2.osx
1282335303jtun_ennfull2.osi
1282335303jtun_ennfull2.osx
1204063402jtun_esa1010.osx
1206558828jtun_ess403.osx
1240252931jtun_ess501.osx
1215646053jtun_ipsengine121.osx
1272471915jtun_liveupdate_5.1.2_english.osx
1258529511jtun_norton_antivirus_11.1.0_english.osx
1261074879jtun_norton_antivirus_11.1.1_english.osx
1261074478jtun_symantec_scheduler_5.1.1_english.osx
1270832124jtun_vulnerability_protection_engine_3.0.0.osx
1280444368jtun_vulnerability_protection_engine_3.1.0.osx
1282352487jtun_vulnerability_protection_signatures100818001.osx

You're talking about LUAU on the Mac?  This is a thread about LUA 2.x on Windows.  This likely should have been a new thread.

To which document are you referring that tells you to set it to NAV for Mac definitions?  I edited the following document extensively after we determined that SEP for Mac definitions could not be served by LUAU.

Title: 'Using the LiveUpdate Administrator on a PC to download updates for Symantec Endpoint Protection/Symantec AntiVirus 10 for Macintosh clients'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007152728050998

The definition files are the same but the product designations are different.

What if anything else changed on 5 August?

sandra

What are you saying?  That the product updates are not supported by LUA on a mac?  We changed nothing on the 5th but somthing defiantely did on your end.

What I'm saying is that as I understand it, LUAU for Mac is not able to serve SEP for Mac updates.  (Believe me, I wish that it did.)  If there is a specific document that you found that suggests otherwise, please let me know so that it can be updated.  LUA 2.2.x is recommended for serving updates to SEP for Mac clients.

I just noticed this in your original log:

Sep 9, 2010 3:14:06 PM Loading guard file:  
/private/tmp/liveupdate/liveupdatehosts/0/url=http:/liveupdate.symantecliveupdate.com:80/1284063245912/liveupdt.grd

It looks like part of the liveupdate.conf file (hosts/0/url=http:/liveupdate.symantecliveupdate.com:80) is part of this address.  This stands out because you're connecting to macavconsole.stp.mrll.com:80 / 10.228.21.165, and you mentioned wanting failover to a Symantec LU server.  What does your configuration LiveUpdate policy for Mac clients look like?  to me, it doesn't even look like it is asking about definitions, just LiveUpdate.

sandra

No, it is not part of the address, it is just a abitrary location in the liveupdate.conf. This entry was defined by SEP and we did not change it.

workdir=/tmp/liveupdatehosts/0/url=http://liveupdate.symantecliveupdate.com:80
 

OK... when I look at my liveupdate.conf file (as a managed SEP Mac client) I see the following defined:

############################################################
#                                                          #
# livepdate.conf - Symantec LiveUpdate configuration file  #
#                                                          #
# This file is used to configure the settings used by      #
# LiveUpdate                                               #
#                                                          #
############################################################

cacheMode=false
hosts/0/url=http://liveupdate.symantecliveupdate.com:80
hosts/1/url=http://liveupdate.symantec.com:80
hosts/2/login:...
hosts/2/mode=passive
hosts/2/password:...
hosts/2/url=ftp://update.symantec.com/opt/content/onramp
logfile=/Library/Application Support/Norton Solutions Support/LiveUpdate/liveupdt.log
maxPackageContentSize=734003200
maxPackageSize=734003200
maxTriFileSize=10485760
maxZipFileSize=614400
workdir=/tmp/liveupdate

The workdir variable is not something that should make a difference to a successful download, but changes to that variable can only be made as a result of direct editing.  There is no way to change that through the SEPM.

As for the client JLU session, it's connecting, getting the minitri.flg, getting the livetri.zip, reading the guard file (liveupdt.grd), then is quitting.  If you want to upload your livetri.zip file, feel free--my feelings are that the internal LU server is offering products the SEP Mac client can't use.

If it was previously working and then stopped, I'm not sure why that would be, since everything I can find indicates it should not have been able to.  If you have a LiveUpdate log from a client that goes back before the 5th of August, feel free to upload that too (as a file attachment).

sandra

Do you have any update on this?  Is your issue resolved, and if so, did anything I suggested help? 

illiterati: how about for you?

 

sandra