Endpoint Protection

Hi All,
I am setting up a test environment to eventually migrate everyone to once the testing is complete with SEP 11 MR5.  Currently we have a LU server at each "location."  I have decided to convert those into GUP's instead for the new environment.  Each of those servers are getting the definitions from the SEPM just fine, but none of the clients that are set to recieve definitions from them are getting them.  The green light is on, showing that connectivity between the SEPM and client is there, and everytime I update a policy it goes down there as well.  I can ping the GUP from each client just fine.  I have tried to look and find some logs, but can't find anything of any significance to help me out.  Any help would be greatly appreciated.

Thanks,
Brian

 If you are using Advanced GUP policy all the clients should be at MR5

I have the same issue. This worked for me in the lab, but now that we've rolled out to the stores, I see the same issue as described above.

11.0.5002.333 version clients at both store server and store registers
Server says Group Update Provider: True
Clients are properly configured to use the server as the GUP, obviously because the server says GUP: True

Using wireshark at the SEPM, I see the server and the registers checking in.
Clients are set to check in every 4 hours.

It has been almost 24 hours since the installation of this store server and the registers, but the registers have still not pulled down the updates from the GUP.

Hi Brian,

Try this workaround :

Limit the number of files stored in \SharedUpdates folder by setting a lower value for "Maximum disk cache size for content updates" or "Delete content update if unused" in policy LiveUpdare > Server Settings > GUP settings.

As rightly suggested please check the version of endpoint on the clients as well. All the machine should be upgraded to RU5. Go through this link and I am sure it will help you.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009092901593448

All client versions are on RU5.  I will try these trouble shooting advices and get back with a conclusion.


Thanks

Sandip_sali,
In the article you posted I see this...

Step 4: Verify that clients are designated as Group Update Providers - You can view the client computers that are designated as Group Update Providers. You can search client computers to view a list of Group Update Providers. A client computer's properties also shows whether or not it is a Group Update Provider.

Is there somewhere that you specify to a client that it IS a GUP?

Also, I am using single GUP with multiple policies...instead of multiple with subnet rules.  This shouldn't be an issue either?

I just got off the phone with support, well over an hour on the phone. We were unable to find any issues with my configuration, it should be working. We are going to create sylink.log files on the clients (not the GUP) tomorrow to see if we can get a better idea of what's going on. If I discover anything, I'll update you. You should probably do the same at your end, create the sylink.log files on the clients not getting their updates.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008041812561948

Robbie,
I got the syslink.log file going just fine.  I will let you know what I come up with...please do the same for me.

Thanks,
Brian

I have submitted my log to support, will have a call with them later today. Will let you konw the outcome.

Should I submit my log here?

So far we have determined that the GUP is not pulling down the updates being requested by the clients. Are going to do more digging in a few minutes.

So now we see on the GUP where it's downloaded the update, but the client isn't pulling it down. We are still digging in at this end.

Brian, you may want to open a support case with Symantec. They will certainly want that log file to work the case.

Telnet & Check the port 2967 is opened or not !!!!

Disable the windows firewall.

Regards...
Ramji Iyyer

Am in the same boat guys - clients are not getting update's from HUP - config appears to be ok and GUP's appear to be GUP's (if you follow me)?

Following this topic...

I've got some "busier" sites that use GUPs that don't update from the GUP server, but they will update from SEPM if I switch policies.  It stays in communication with the SEPM server and I can make any policy changes, etc.

Other than updates to RU5 from previous version, nothing else has changed in the configuration of policies.  I have a Single GUP configuration.  I have a sinking feeling it's related to a "subnet" issue that's supposed to be used for the multiple GUP configuration.   

Well I enabled Telnet on both the client and Server and am not able to Telnet into either of them from either way.  "Could not open connection to the host on port 2967: Connect failed.  The clients are Windows 7 and the server is Windows 2008.  Could this be a problem?  Windows firewall has been disabled on both client and server the whole time.

Brian - I'm pretty sure you should see a blank screen if the server is responding on that port. Then if you hit another key it takes you out to a command prompt again, so it sounds like you are on the right track there.  Your GUP should provide a response on that port.  Good luck!

Regarding my issue, I don't know if this helps anyone else, but after a number of hours online with Symantec Support, there is a known "bug" in RU5 where if you have your SEPM data directory installed in a location different than the program default, GUPs do not update the clients.  I was told either the next MR (which is currently in development but not scheduled) or to run the SEPM configuration Wizard out of the Program Files directory and change the Data folder back to the default to fix the issue. 

Ok...So I have some more info here.  On neither of my GUP boxes is port 2967 even listening.  If I do a netstat on either of the servers, that port is not listed.  I keep coming back to how do you let the client on the GUP server itself know that it IS the GUP client and should be listening on that port???

Also when I search for Group Update Providers = True in client search I get nothing.  What do you have to do to tell the client that it IS a GUP? 

With everything on RU5, you have to:
1) Specify the GUP(s) in your LiveUpdate policy.
2) You then have to apply this policy to the group(s) where your clients reside *and* the group where your GUP(s) resides.

If the GUP policy is not applied to the group where the server or intended GUP resides, it will not know it is supposed to be a GUP.

HTH.

Ok...I did so, we will see what happens.  How are the GUP's able to get their updates if their policy is to get it from themselves?  Do they automatically know ot get them from the SEPM server?

Everything is working now, thanks for all your help everyone.

Hi Brian,

When you specify a machine to be a GUP, that machine will take the definitions from SEPM. You can check the following videos and let us know if you any questions.

https://www-secure.symantec.com/connect/videos/group-update-providers-part-1

https://www-secure.symantec.com/connect/videos/group-update-providers-part-2

Aniket

I have the same configuration and I still have a doubt
If clients and GUP are on the same group how do I have to configure the liveupdate policy?
do I have to configure SEP manager and GUP?

Another question:
if the client is updating from GUP should I see on Help and Support -> troubleshooting -> General Server : the name of the GUP?

thanks

Birij

If clients and GUP are on the same group how do I have to configure the liveupdate policy?
In the LU Policy you just need to select the GUP option

do I have to configure SEP manager and GUP?
It will done automatically when the GUP is configured in the LU policy

if the client is updating from GUP should I see on Help and Support -> troubleshooting -> General Server : the name of the GUP?

NO

If GUP is selected in LU policy, as well as the internal LU server are defined in the LU policy, where the client will get the defintion? GUP and then SEPM only or Liveupdate server and GUP and then SEPM? also, if client only can get defintion from GUP on the same subnet, how could the GUP support 10,000 clients now?

How do you make the determination where the cilient is getting its updates from?  GUP? SEPM? LiveUpdate?