Endpoint Protection

 Yesterday I was faced above live update issue but on that time I have got resolution but today I have still not recieve update and below event have generated on server. Pls help

LiveUpdate returned a non-critical error. Available content updates may have failed to install.

check this link, if it does not help pass on log.liveupdate.,

https://www-secure.symantec.com/connect/forums/sepm-liveupdate-has-error-liveupdate-encountered-one-or-more-errors-return-code-4

Possible Causes: Legacy proxy settings in the registry still persist after environmental changes on client machine.

Solution

The legacy proxy settings can be removed by performing the following steps:

1.   Open the registry (Start->Run->type "regedit").

2.  Go to HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\InternetSettings\connections

3.  Delete the registry keys "DefaultConnectionSettings" and "SavedLegacySettings".

4.  Reboot the machine.

Note:  These registry keys will automatically regenerate after reboot of machine.

Also, this also could be caused due to incorrect proxy server information in the following registry location: HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\InternetSettings

Removing the incorrect proxy info from this key and then rebooting allowed the client to communicate normally.

One important thing to keep in mind is that any incorrect proxy information must also be removed from the following two locations as well:

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

If the settings are not removed from these two keys, they will repopulate the Internet Settings key after every reboot.

Remove the incorrect proxy information from all 3 registry locations noted above, then reboot.

Just to add, in many of my cases, where was an issue with the System Account at User Proxy Level. They had to Bypass the Proxy on the server.

Hello Sumit ,

Is this version 12.1 after upgrade ?

Could you please post log.liveupdate in zip format ?

In event id do you see sesclu 13

Hi- Can I change/delete in the registry on Server??

Hi- Sep Server version is 11.0.6005. Share the path of  log.liveupdate

Hi

  Now the below error is display while running the luall command manually

check the taskmanager, it seems to be LUall.exe is already running, hence the message.

You may want to reinstall Liveupdate on this machine and then register

http://www.symantec.com/business/support/index?page=content&id=TECH102609&locale=en_US

Hi Same error i have day before day. On that time I have endtask the service of Lucoms~1.exe. Then it work but same it now. So any idea to resolve without uninstallation..

Hi- this error has started when i have change the Live Update setting as dailybase.

Below is the snap of LU setting

Is it ok, pls confirm

let the lucome exit on it's own. It might be in process of downloading the definition.

Dear,

Your Symantec Live Update is cruppted.

Please install the LUsetup  (liveupdate) agin on machine.

then go to run and type luall command.

your problem will be resolve...

Hi I want to confirm that, I have set the live update as a dailybase.

Download time mention in above comments.

Retry interval time is 15 minute.

Retry window is one hour.

Is it ok.

What the role of Retry interval 7 Retry window there.

Pls confirm because I have update the same setting at last week. Till time i have not get any update automatically.

Hi,

    can you help me to set the update setting. Server get update on timely but client will be update at evening under the timing of 11:00pm  to 7am.

I want to confirm that if I have setted the Retry interval at 15 min, it mean that it will retry after 15 min if not get update, then what the mean of "Retry window" because it has setted 1 hour??

Hi,

  I am going to set the client update setting as per below attach snap.

Daily Base nad update time"10:30pm" & keep trying for 7 hours.

Server setting will be set continuosly then is it possible that server get update daily on time and client will be update at evening time"10:30pm"

retry every 15 minutes for 1 hour time window

client will trigger the Liveupdate between said hour, to get the updates from Symantec Liveupdate,

It's mean if I have set the time of daily (10:30pm to 3:00am). It will retry to update after 15 min till 1 hour. After 11:30pm it will not be try again till next day.

it mean if I set client time at 10:30 daily and keep trying 7 hours. Then client will try to get update at 10:30pm till 7hours(6:30 am)

yes, it will try if the scheduled one is incomplete or cannot run.

Hello Sumit,

In your case, when the Running the Luall.exe from the START > Run window you receive an Error LU1823, in that case, you can work on this:

http://service1.symantec.com/SUPPORT/sharedtech.nsf/38d4e82edf5ecb2e85256ed700450c69/d8e199731f6e34bf80256ccb004cbea8?

Coming back to your Original Issue of "LiveUpdate encountered one or more errors. Return code = 4", 

You are SEPM version 11.0.6005. Please upload the log.liveupdate from C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate

That would assist us getting to the Root cause of the issue.

Hi- Pls find the attachment.

Attachment(s)

Log.LiveUpdate_12.txt   3.26 MB 1 version

looks like LU was unsuccessful

2/6/2012, 15:47:54 GMT -> EVENT - SESSION END SUCCESSFUL EVENT - The LiveUpdate session ran in Express Mode. LiveUpdate found 2 updates available, of which 0 were installed and 2 failed to install.  The LiveUpdate session exited with a return code of 1800, Success

2/6/2012, 16:04:55 GMT -> EVENT - SESSION END FAILED EVENT - The LiveUpdate session ran in Silent Mode. LiveUpdate found 0 updates available, of which 0 were installed and 0 failed to install.  The LiveUpdate session exited with a return code of 1814, LiveUpdate could not retrieve the catalog file of available Symantec product and component updates.

1814 error, i would say try reinstall LU and check

http://www.symantec.com/business/support/index?page=content&id=TECH102609&locale=en_US

Firstly go to command prompt and give cleanup & then update command as below

%Program Files%\Symantec\Symantec Endpoint Protection Manager\Bin"  and type "lucatalog -cleanup" and then the next command as  "lucatalog -update"

Hello,

I agree with Pete.

As of now, after looking at the Logs, the only thing is to Uninstall and Reinstall the Liveupdate Application.

Check this Article -

http://www.symantec.com/docs/TECH102609

Hope that helps!!

Please do the following:

1. Unistalled the Liveupdate

2. Restart the Server.

3. Install the Liveupdate.

: To re-register the SEPM with LiveUpdate, follow the steps below:

1. Open a command window, then browse to:
   C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin
   
2. Type lucatalog -update and press Enter.
3. Run LiveUpdate to verify that there are no errors.

 For Symantec Endpoint Protection 12.1, follow the steps below:

1. Open a command window, then browse to:
   C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin
   
2. Type lucatalog -cleanup and press Enter.
3. Type lucatalog -forcedupdate and press Enter.
4. Run LiveUpdate to verify that there are no errors.

Regards

Hi Pete/Mithun,

Today I have set the live update setting as continuously. After that it working fine till time

Attachment(s)

Log.LiveUpdate_13.txt   3.96 MB 1 version

yea :-), however note that running LU continous would be resource consuming

2/8/2012, 7:22:51 GMT -> EVENT - SESSION END SUCCESSFUL EVENT - The LiveUpdate session ran in Silent Mode. LiveUpdate found 12 updates available, of which 11 were installed and 1 failed to install.  The LiveUpdate session exited with a return code of 1800, Success

2/8/2012, 7:46:41 GMT -> EVENT - SESSION END SUCCESSFUL EVENT - The LiveUpdate session ran in Silent Mode. LiveUpdate found 2 updates available, of which 2 were installed and 0 failed to install.  The LiveUpdate session exited with a return code of 1800, Success

Hello,

I agree with pete again.

NOTE that when you set the liveupdate to update continuously it would consume lot of your resource and Bandwidth.

The Continuous setting causes the client computers that are infrequently powered on or that infrequently communicate with a management server to get the latest updates. They get the latest updates when they connect to the network and authenticate to a Symantec Endpoint Protection Manager.

The Symantec updates its definitions only thrice a day. So again, the question arises why to waste the valuable resources?

Here is an Article to Understand the Liveupdate Policies - http://www.symantec.com/docs/TECH104435

k. Pls confirm if I will set the blow setting in client then will pick defintion from default manager server or from any other path??

i believe that is for client LU policy, correct?

highlight server settings. The source there will tell which one you have selected. If you select Symantec Liveupdate and SEPM, the client might get definition from either one of them.

Yes this client LU Setting. i have set the below setting, pls find the attach below snap

the configuration is to get the updates from SEPM as well as SYmantec Liveupdate.

Whenever the LU on client triggers it will connect to symantec liveupdate to check for new content, if it is present then it will download.

hi- i have raise the case in symantec tool. one engg have removed the old defintion. after that it working but till case is in observe

I have had the same problem, even after removed old definition I have the same situation after few days.

then what the step you have resolved it.?