Endpoint Protection

Hello,

I have noticed that some of the v12 clients are not updating their virus definitions at all. I perform a smc -stop/start and this then gets them going again however I do not want to have to check them every day to see what needs updating.

This is not a network issue as once I have stopped/started smc they then update correctly.

Any ideas?

Thanks

Is the client getting the updates from SEPM?

How is the client communication push/pull? If pull what is the heartbeat?

What is the exact version of the Manager and clients?

Hello,

In your case, when you are re-starting the SMC client services, the heart beat first communicates and checks with the SEPM for updates and that is when it receives the updates.

So, are this clients in Pull mode or Push mode and what is the Heartbeat Interval set for this clients to communicate to SEPM??

Hope that helps!!

Hello all and thank you for your assistance with this.

The clients and server are both at version 12.1.671.4971.

The client groups are inherited from the default, with one group which is not however they all have the same communication settings: Push mode and a heartbeat of 5 Minutes randomised.

The only thing that is different from Mithun Sanghavi's image above is that the Managment Server List is set to New Management Server List.

Thanks again for having a look at this!

I have the same issue.

In the console I see that some PC's have Otober 3rd update and most of them still September 30th.

One client was able to update when he opened up SEP and click on the live update link.

I'm in Push mode

Awaiting impatienly for a reply

same issue for me. Of my 80 clients, I have about 3 or 4 that won't update. Some consistently fail, other times I will have new pcs that fail.

v12.1.671.4971

If I look in the system log, I see an indication that the update from management server failed. When I paste the failed remote file path into a browser, it downloads the file just fine.

Ok Guys, we've the same problem here too.

10 of our 100 clients did'nt update their def's from the central av server.

Client Version is 12.1.671.4971, Server is at RTM 12.1 stage.
Server configuation is as mentioned above:
- push
- 5 min pulling interval

We have an mixed environment of some 70% old SEP 11.0.6 clients and some stations already updated with the new 12.1 client. But we stopped the client-update process while cleaning out the problems.

In the client log we faced the same problems as stated by lwarring before.
Client said it can't load the definitions but manual download runs perfectly.

We found an workaround for now and updated the correponding stations manually via LiveUpdate.

I would be pleased if an sym-tech-guy dig into that case.

Thanks in advance

Ralf

Hi,

Could you please explained are these client get update fro GUP server or stright from the SEPM?

And how many SEP client network you have?

Regards

Neeraj

In my instance, all updates come from the SEPM in a client base of about 60.

This week the clients are different from the last week, which were different from when I first found the issue.

PSexec with a smc.exe -stop / -start will fix the clients who fail but this is a real pain.

do ytou have the sylink logs from the client when it is not updating?

Our client installs get their updates straight via SEPM and we've about 100 clients.

The problem seems to have been solved via one time manual LiveUpdate from symantec servers.
Now they get the recent updates via SEPM.

Due that case I cant provide an log with some maybe faulty info.

Hope we face that problem never again - the LiveUpdate workaround is also practicable with small install bases only.

Greetings

Ralf

pete_4u2002, where are the sylink logs located. Is that the system log I see from the UI, or a seperate file ?

do you really want a log file posted in the forum ?

Got the same issue.

"Downloaded new content update from the management server failed."

If I run a manual LiveUpdate from the cleint GUI it updates just fine.

Hiting that path allows me to download the file.

OS are a mix of Windows 2003 to 2008 but mostly 2003.

Client seems to be talking to the managment server otherwise - just not getting all the updates.

do you have the sylink logs from the client when it is not updating?

Where can I find these so that I can get them here? We now have 9 clients which have not updated.

These clients are different to the previous ones.

This needs to be sorted - it isn't much of a protection suite when it does not update to the latest definitions.

One comment I have is that one of the server that has a habit of not auto-updating is the Endpoint Manager server itself - and Endpoint is it's only task at the moment.

Up to 14 clients out of 60 which are not updating. As Matt Carlson has mentioned, this also includes the SEPM Server.

I have edited the LiveUpdate Policy to enable downloading from both the default managment server as well as using a liveupdate server. I will see if this makes a difference - I am sure it will to the bandwidth used.

Is anyone from Symantec looking into this? I would be happy to keep updating the clients manually as long as I know someone is looking into this issue and that there may be a possible fix in the near future.

I have now enabled SyLink logs as per https://www-secure.symantec.com/connect/articles/how-enable-sylink-logs-registry so I will see what comes of that.

Cheers

*edit: Changed link

http://www.symantec.com/business/support/index?page=content&id=TECH166923&actp=search&viewlocale=en_US&searchid=1321397255292

Can you give this a go and let me know if this solves the issue? I have tried it and most of the clients updated soon afterward, I just don't know how long they will continue updating - hopefully for ever!

I cannot seem to access your link, could you provide me another one, or let me know what to search for?

Thanks!

Try searching for "SEPM(SEPM) 12.1 is not updating 32 or 64 bit virus definitions." Seems like the Symantec site is playing up...

Oh, and I should mention that I am still getting the same problems, even after trying the above.

Thanks for the info!

I have the same issue that you guys are having.

I have 1500 Clients and 95% of them are version 12.1 RU1 and so is my SEPM

Every day I am getting notifications that 30-40 clients are not updating. If I restart the smc service and wait a while it finaly updates.

My SEPM is setup to Push mode with a 5minute heartbeat with any client on the LAN and Push mode with a 30minute heartbeat with any client across the WAN.

All the clients on the WAN are using GUP's per subnet and everything on the LAN is talking directly to the SEPM.

One thing I have noticed however is that 90% of the clients that I visit to restart the smc service on they are logged out and the PC is sitting at the login screen. From there I dont bother logging in and I just give it a restart (pretty much same thing). And then again the other 10% are logged in.

So not to sure what is happening here but this didnt happen on 11.6 from memory.

Is there any update on this by symantec yet?

well, to make it easier for me (and you if you choose to use it), I have made a quick psexec bat file for stopping and starting smc on a list of clients.

Choose to use it or not, but at least now I can copy an paste the list of clients not updating into the clients.txt file and hit go and it will stop/start SMC and hopefully then update correctly.

Just change all instances of  'LOGPATH' in the batch file to your preferred logging directory.

Attachment(s)

SMCRestart.zip   182 KB 1 version