Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SEP client can't downloadin anitivirus and antispyware definitions from SEP Server

Created: 30 Aug 2013 • Updated: 17 Sep 2013 | 24 comments
This issue has been solved. See solution.

SEP version : 11.0.6300.803

I face problem on sep client around 100 client can't downloading antivirus and antispyware definitions as below figure.

I deleted definition and distribute on SEP server and try to download and distribute againd but it doesn't work. 

I created new policy and installation package it still can't work.

I checked client communication with SEPM follwing below link can communication well.

http://www.symantec.com/business/support/index?page=content&id=TECH95789

SEP_problem.jpg

Can everyone help me to investigate and recomment?

remark : I have 2 SEPM server as the same version and when i try to setup SEP package on another server it can download antivirus and antispyware by normally.

Operating Systems:

Comments 24 CommentsJump to latest comment

Ambesh_444's picture

Hi,

Please check these article's.

Troubleshoot and Best Practices

https://www-secure.symantec.com/connect/forums/any-link-download-troubleshoot-documents

https://www-secure.symantec.com/connect/articles/symantec-endpoint-protection-110-troubleshooting-guide

Thank& Regards,

Ambesh

"Your satisfaction is very important to us. If you find above information helpful or it has resolved your issue. Please don't forget to mark the thread as solved."

James007's picture

Edit the file Settings.LiveUpdate

Default Location : "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate"

Open the file in notepad and find

HOSTS\1\ACCESS=liveupdate.symantec.com
HOSTS\1\ACCESS2=http://abcd.xxxxx.com

Replace the above server location with the correct location ie. http://liveupdate.symantec.com

Run the LiveUpdate

LU1834: LiveUpdate could not find an update file on the server, Please run LiveUpdate again.

Article:TECH174036  |  Created: 2011-11-09  |  Updated: 2012-08-18  |  Article URL http://www.symantec.com/docs/TECH174036

If above artical not work please check this artical

Symantec AntiVirus error: "LU1834 - LiveUpdate could not find an update file on the server. Please run LiveUpdate again."

Article:TECH102523  |  Created: 2007-01-26  |  Updated: 2009-01-26  |  Article URL http://www.symantec.com/docs/TECH102523
phoorich.p@hotmail.com's picture

thx Jame007

your Article:TECH174036 is not worked for me, i will try to continue to test with Article:TECH102523

Rafeeq's picture

If you click on download liveupdate or luall.exe from cmd then  liveupdate will not go to SEPM, it will always go to internet. 

It will only download when this client has internet access. 

Open liveupdate in control pannel

select Liveudpate

select the mode as interactive

run LU

select only small components , run the download.

If you want to get the updates from SEPM. Right click on yellow sheild and update policy.

Ambesh_444's picture

Hello phoorich,

Please update the status and if your problem is resolved then mark as a solution thread which help you best.

Thank& Regards,

Ambesh

"Your satisfaction is very important to us. If you find above information helpful or it has resolved your issue. Please don't forget to mark the thread as solved."

phoorich.p@hotmail.com's picture

Hi Ambesh_444,

Good morning,

I following with many solution but it still doesn't work

I have to update virus and antispyware definitions from SEP Server[Internal Server] not update from web

it's ok when I test by using third party management policy but it not my concept, i think this cause is problem on client right? i'm not sure and continue to find put solution to fix it.

thx all,

Rafeeq's picture

How do you want to update your clients ?using SEPM?

If you click on download liveupdate from the SEP interface or luall.exe from run then  liveupdate will not go to SEPM, it will always go to internet.

first you need to check if your client is able to talk to sepm. i.e, open SEPM help and support and troubleshooting , does it show server name or offline?

is your SEPM uptodate? need more info on this one.

phoorich.p@hotmail.com's picture

Hi Rafeeq,

Sure, all my problem client can connect to SEPM manager and it show me "Server name" on troubleshooting menu

many client which not same problem can update virus and antispyware definitions normally.

Rafeeq's picture

if the client is talking to SEPM then it should take updates

You can enable the sylink loggin to see why its not taking updates

http://www.symantec.com/business/support/index?page=content&id=TECH104758

before enabling this I would want you to clear all the corrupt defs on the client and enable update policy

if it still does not udpate defs, post the sylink log

How to clear out corrupted definitions for a Symantec Endpoint Protection client manually

 

http://www.symantec.com/business/support/index?page=content&id=TECH103176

phoorich.p@hotmail.com's picture

Hi Rafeeq,

i did on your sugguestion and how to do next or how to analysis with sylink.log

current my situation as below figure

eeeee.JPG

Rafeeq's picture

If you click on liveupdate from Client screen it will go to interent for udpate and not for SEPM
On the same SEP screen

click on help and support - troubleshooting (right corner)

update policy

wait for few mins then upload the sylink log.

Do you have proxy in your network?

phoorich.p@hotmail.com's picture

i used proxy server in my network.

i capture liveupdate policy and client setting screen in below figure

Liveupdate Policy

liveupdate.JPG

Client

lu.JPG

Rafeeq's picture

Post the lue log found here. Seems like its not finding any updates. 

On Windows XP and Windows server 2003:
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs

On Windows Vista, Windows 7, and Windows Server 2008:
C:\Program Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs

or liveupdate.log file from the client if you are running 11.X version

Mithun Sanghavi's picture

Hello,

1834 - The HTTP transfer failed because the requested file did not exist on the server. This is an update not found error, not a missing TRI file error.

Check these Threads with similar issue  - 

https://www-secure.symantec.com/connect/forums/lu1834-cannot-find-update-file-server

https://www-secure.symantec.com/connect/forums/liveupdate-downloaded-all-updates-you-requested-all-them-failed-install

Secondly, check this Article:

http://service1.symantec.com/SUPPORT/ent-security.nsf/b7186c7fefd6f0c3882573410063493e/d89f03914811bd5988257362007787df?OpenDocument

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

pete_4u2002's picture

from the policy the client will get the updates from internal LUA. Liveupdate log will tell whats the size of teh content it downloaded.

Is the LUA on different network segment?

AjinBabu's picture

HI,

Please make sure the clients are able to access the LUA server and check the LiveUpdate log on the clients.

Also remove the Symantec LUA server (on priority no 2) option and test it, and let us know the outcomes.

Regards

Ajin

Rafeeq's picture

I do see HttpSendRequest (status 404): Request failed

what version of LuAdmin you have installed?

Did you sync the catalog for SEP 11.X? Can you download new set of defs again from Luadmin

delete all the contents inside the Downloads folder and run the udpate again.

And also open control pannel

open liveudpate

make the session as interactive

start -run

type luall.exe

try downloading only small content, check if that succeds

http://www.symantec.com/business/support/index?page=content&id=TECH138929

phoorich.p@hotmail.com's picture

Hi Rafeeq,

answer your question

what version of LuAdmin you have installed?

******* My LUAdmin version is 2.2.2.9

Did you sync the catalog for SEP 11.X? Can you download new set of defs again from Luadmin

delete all the contents inside the Downloads folder and run the udpate again.

******* I will try again, I tried this solution in many times it can download and distribute by success

thx for your always help!

Rafeeq's picture

if you see the log  ( you can open that in a notepad) its showing up 404 file not found on your Luadmin.

Try manually searching for that file on your Luadmin just to make sure that it exists.. does it ??

Since you have SEPM its good to point your SEPM to get updates from Luadmin

and then your clients to get update from SEPM.

If clients are in different subnet or something you can always use GUP

phoorich.p@hotmail.com's picture

hi all,

This problem was solved.

Solution:

1.Delete virus definition folder "C60DC234-65F9-......." and "1CD85198-26C6-......" that are contain in path

C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\content

2.Delete all distribution data in folder "clu-prod" and "clu-test" that are contain in "LiveUpdate Administrator" folder

3.Manual download and distribution request [it take times and many times to complete]

4.In my case after download and distribution completed wait for around 1 hour, client can liveupdate by normally!!!!

long time to solve T^T

Thank you every one to help and suggesstion!!

SOLUTION