SEP version : 11.0.6300.803

I face problem on sep client around 100 client can't downloading antivirus and antispyware definitions as below figure.

I deleted definition and distribute on SEP server and try to download and distribute againd but it doesn't work. 

I created new policy and installation package it still can't work.

I checked client communication with SEPM follwing below link can communication well.

http://www.symantec.com/business/support/index?page=content&id=TECH95789

Can everyone help me to investigate and recomment?

remark : I have 2 SEPM server as the same version and when i try to setup SEP package on another server it can download antivirus and antispyware by normally.

Hi,

Please check these article's.

Troubleshoot and Best Practices

https://www-secure.symantec.com/connect/forums/any-link-download-troubleshoot-documents

https://www-secure.symantec.com/connect/articles/symantec-endpoint-protection-110-troubleshooting-guide

thx Ambesh_444 i will try to investigate with your article's link

Edit the file Settings.LiveUpdate

Default Location : "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate"

Open the file in notepad and find

HOSTS\1\ACCESS=liveupdate.symantec.com
HOSTS\1\ACCESS2=http://abcd.xxxxx.com

Replace the above server location with the correct location ie. http://liveupdate.symantec.com

Run the LiveUpdate

LU1834: LiveUpdate could not find an update file on the server, Please run LiveUpdate again.

If above artical not work please check this artical

Symantec AntiVirus error: "LU1834 - LiveUpdate could not find an update file on the server. Please run LiveUpdate again."

thx Jame007

your Article:TECH174036 is not worked for me, i will try to continue to test with Article:TECH102523

If you click on download liveupdate or luall.exe from cmd then  liveupdate will not go to SEPM, it will always go to internet. 

It will only download when this client has internet access. 

Open liveupdate in control pannel

select Liveudpate

select the mode as interactive

run LU

select only small components , run the download.

If you want to get the updates from SEPM. Right click on yellow sheild and update policy.

Hello phoorich,

Please update the status and if your problem is resolved then mark as a solution thread which help you best.

Hi Ambesh_444,

Good morning,

I following with many solution but it still doesn't work

I have to update virus and antispyware definitions from SEP Server[Internal Server] not update from web

it's ok when I test by using third party management policy but it not my concept, i think this cause is problem on client right? i'm not sure and continue to find put solution to fix it.

thx all,

How do you want to update your clients ?using SEPM?

If you click on download liveupdate from the SEP interface or luall.exe from run then  liveupdate will not go to SEPM, it will always go to internet.

first you need to check if your client is able to talk to sepm. i.e, open SEPM help and support and troubleshooting , does it show server name or offline?

is your SEPM uptodate? need more info on this one.

Hi Rafeeq,

Sure, all my problem client can connect to SEPM manager and it show me "Server name" on troubleshooting menu

many client which not same problem can update virus and antispyware definitions normally.

if the client is talking to SEPM then it should take updates

You can enable the sylink loggin to see why its not taking updates

http://www.symantec.com/business/support/index?page=content&id=TECH104758

before enabling this I would want you to clear all the corrupt defs on the client and enable update policy

if it still does not udpate defs, post the sylink log

How to clear out corrupted definitions for a Symantec Endpoint Protection client manually

http://www.symantec.com/business/support/index?page=content&id=TECH103176

Hi Rafeeq,

i did on your sugguestion and how to do next or how to analysis with sylink.log

current my situation as below figure

If you click on liveupdate from Client screen it will go to interent for udpate and not for SEPM
On the same SEP screen

click on help and support - troubleshooting (right corner)

update policy

wait for few mins then upload the sylink log.

Do you have proxy in your network?

find the link to enable sylink logging

http://www.symantec.com/business/support/index?page=content&id=TECH102412

i used proxy server in my network.

i capture liveupdate policy and client setting screen in below figure

Liveupdate Policy

Client

from the policy the client will get the updates from internal LUA. Liveupdate log will tell whats the size of teh content it downloaded.

Is the LUA on different network segment?

HI,

Please make sure the clients are able to access the LUA server and check the LiveUpdate log on the clients.

Also remove the Symantec LUA server (on priority no 2) option and test it, and let us know the outcomes.

Regards

Ajin

Post the lue log found here. Seems like its not finding any updates. 

On Windows XP and Windows server 2003:
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs

On Windows Vista, Windows 7, and Windows Server 2008:
C:\Program Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs

or liveupdate.log file from the client if you are running 11.X version

i enclosed log.liveupdate on problem client in attached.

Attachment(s)

Log_3.7z   74 KB 1 version

Hello,

1834 - The HTTP transfer failed because the requested file did not exist on the server. This is an update not found error, not a missing TRI file error.

Check these Threads with similar issue  - 

https://www-secure.symantec.com/connect/forums/lu1834-cannot-find-update-file-server

https://www-secure.symantec.com/connect/forums/liveupdate-downloaded-all-updates-you-requested-all-them-failed-install

Secondly, check this Article:

http://service1.symantec.com/SUPPORT/ent-security.nsf/b7186c7fefd6f0c3882573410063493e/d89f03914811bd5988257362007787df?OpenDocument

Hope that helps!!

I do see HttpSendRequest (status 404): Request failed

what version of LuAdmin you have installed?

Did you sync the catalog for SEP 11.X? Can you download new set of defs again from Luadmin

delete all the contents inside the Downloads folder and run the udpate again.

And also open control pannel

open liveudpate

make the session as interactive

start -run

type luall.exe

try downloading only small content, check if that succeds

http://www.symantec.com/business/support/index?page=content&id=TECH138929

Hi Rafeeq,

answer your question

what version of LuAdmin you have installed?

******* My LUAdmin version is 2.2.2.9

Did you sync the catalog for SEP 11.X? Can you download new set of defs again from Luadmin

delete all the contents inside the Downloads folder and run the udpate again.

******* I will try again, I tried this solution in many times it can download and distribute by success

thx for your always help!

if you see the log  ( you can open that in a notepad) its showing up 404 file not found on your Luadmin.

Try manually searching for that file on your Luadmin just to make sure that it exists.. does it ??

Since you have SEPM its good to point your SEPM to get updates from Luadmin

and then your clients to get update from SEPM.

If clients are in different subnet or something you can always use GUP

Hi

What is the database they are using

Regards

hi all,

This problem was solved.

Solution:

1.Delete virus definition folder "C60DC234-65F9-......." and "1CD85198-26C6-......" that are contain in path

C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\content

2.Delete all distribution data in folder "clu-prod" and "clu-test" that are contain in "LiveUpdate Administrator" folder

3.Manual download and distribution request [it take times and many times to complete]

4.In my case after download and distribution completed wait for around 1 hour, client can liveupdate by normally!!!!

long time to solve T^T

Thank you every one to help and suggesstion!!