Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SEPM 12.1.2 don't find any updates

Created: 01 Mar 2013 • Updated: 11 Mar 2013 | 32 comments
This issue has been solved. See solution.

I have 2 networks one with Internet access and the other doesn't not. I installed SEPM and LUA in both networks but the internal network's SEPM always say no new updates had been found. I tried different routes as follow:

a)  In the "Internet Network", LUA gets the updates from Symantec and distribute. The SEPM grab the updates from the LUA server.

     The SEPM in the "Internal Network" grab updates from the "Internet Network's" LUA server.

b)  In the "Internet Network", LUA gets the updates from Symantec and distribute. The SEPM grab the updates from the LUA server.

     In the "Internal Network", LUA gets the updates from the "Internet Network" LUA server and distribute. The SEPM In the "Internal Network" grab the updates from the In the "Internal" LUA server.

I checked in both cases the LUA get the updates everyday but the "Internal" SEPM cannot update. It do not give any error instead saying that no new updates found !!!!

Can anyone help me on this ???

Thanks.

P.S.  Both configurations were running without problem when version 12.11.

Operating Systems:

Comments 32 CommentsJump to latest comment

.Brian's picture

Check this troubleshooting KB article:

LiveUpdate and content troubleshooting for the Symantec Endpoint Protection Manager

Article:TECH105924  |  Created: 2008-01-16  |  Updated: 2012-03-30  |  Article URL http://www.symantec.com/docs/TECH105924

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

pete_4u2002's picture

did you try reinstalling LU on the SEPM to check if it gets updates?

Hon Kai Chu's picture

Tried serveral times on both netowks but no luck !!! I even re-installed both SEPMs but got the same result.

Hon Kai Chu's picture

Tried before but no luck !! I checked the LUA in the "Intranet" gets the updates from the "Internet" LUA. It just the SEPM in the "Intranet" keep saying "No updates found" and "Updates completed successful" !!!

SebastianZ's picture

Is there anything between the intenal SEPM and intenet LUA that could cause here communications issues? Is the distribution center of the Internet LUA located on same LUA?

Hon Kai Chu's picture

The LUA and the SEPM of each network are in the same box in each network..

I'll use (I) as Internet and (NI) as non-Internet to make it easier to explain in the two networks.

I can get updates from Symantec to (I) LUA.

I can get updates from (I) LUA to (NI) LUA.

I can get updates from (I) LUA to (I) SEPM.

I cannot get updates from (I) LUA to (NI) SEPM.

I cannot get  updates from (NI) LUA to (NI) SEPM.

SebastianZ's picture

So if I understand correctly in all of the possible scenarios the (NI) SEPM is problem? If yes try to reinstall Liveupdate on that SEPM:

 1. Remove Live update from "Add/ Remove Programs"

 2. Reboot the machine

 3. In Windows Explorer, if they are present delete the following folders,  without saving the existing content:

 - C:\ProgramData\Symantec\LiveUpdate

 - C:\ProgramData\Application Data\Symantec\LiveUpdate

 - C:\Program Files (x86)\Symantec\LiveUpdate  4. Install LU using lusetup.exe (execute with local admin rights - build in administrator)

 5. in C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin:

 - Type lucatalog -cleanup and press Enter.

 - Type lucatalog -forcedupdate and press Enter.

 6. in  C:\Program Files (x86)\Symantec\LiveUpdate start luall.exe (execute  with local admin rights) 

7. Please let the Live update express session run till the end and check if  any errors are occuring 

8. If the session was successfull check the path: "D:\Program Files  (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\content" to see  if there is any content downloaded - you should see here several folders 

* Just a note a configuration of SEPM and LUA running on same box is not really recommended and can cause issues:

http://www.symantec.com/docs/TECH105076

Hon Kai Chu's picture

I actually re-installed the whole thing (Win 2008r2, SEPM and LUA) in a new box to make sure no any other programs would affect the process. But anyway I'll try your method again to confirm.

I understand that the SEPM and LUA should not be in the same box. The LUA in the (NI) side was installed after tried all other options but still not work.

.Brian's picture

Correct. SEPM and LUA should be spearate.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Mick2009's picture

Hi Hon Kai Chu,

Your solution might be quite simple - SEP 12.1 RU2 uses different definitions than earlier versions of SEP 12.1.  Both the external and internal LUA servers need to have their Symantec Product Catalog (SPC) updated, and then they have to be configured to download and distribute the current SEP 12.1 RU2 materials. 

Here is a pair of articles that may help:

Some LiveUpdate Administrator 2.x Servers Fail to Provide Symantec Endpoint Protection 12.1 RU2 Definitions
http://www.symantec.com/docs/TECH201363 
 

About Updating the Symantec Product Catalog in LiveUpdate Administrator 2.x
http://www.symantec.com/docs/TECH201472

Please check the LUA server event logs to see if the SPC is updating!

With thanks and best regards,

Mick
  

With thanks and best regards,

Mick

Hon Kai Chu's picture

Thanks Mick,

The SEPM seems getting updates from the LUA. Will keep monitoring for few more days to confirm working.

Hon Kai Chu's picture

It is running but keep giving this error from the SEPM.

"Symantec Endpoint Protection Manager could not update Submission Control signatures 12.1 RU2."

Any idea??

I checked the LUA has this item and had been updated.

Mick2009's picture

Hi Hon Kai Chu,

Some components are updated frequently (three times a day for AV defs) and some only once is a while.  Check out this article, about a similarly "old" definition date:

"Centralized Reputation Settings 12.1" appears not to update in Symantec Endpoint Protection Manager
http://www.symantec.com/docs/TECH199619 
 

The Submission Control Signatures 12.1 RU2 on my own SEPM are dated August 24 2012.  If that is what yours displays, then all is OK.

If you are seeing an troublesome error message, can you attach the log.liveupdate from the SEPM?

With thanks and best regards,

Mick

With thanks and best regards,

Mick

Hon Kai Chu's picture

The version in the SEPM is dated "12/01/2010 r96". In the Internet network's LUA ans SEPM is "08/24/2012". Any idea???

Hon Kai Chu's picture

Where is the "log.liveupdate" located?? Couldn't find it.

Thanks.

.Brian's picture

See location of log per this KB

The Log.LiveUpdate file is missing or out of date on a Symantec Endpoint Protection 12.1 client

Article:TECH168602  |  Created: 2011-08-31  |  Updated: 2012-03-02  |  Article URL http://www.symantec.com/docs/TECH168602

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Hon Kai Chu's picture

That is for the clients but we're talking about the SEPM. I searched the drive but didn't find it.

Mick2009's picture

The SEPM still uses the LiveUpdate software which makes the log.liveupdate file. (SEP clients use a different technology called LUE.)

Look in  C:\ProgramData\Symantec\LiveUpdate  as this is Win2008 you have.

With thanks and best regards,

Mick

Hon Kai Chu's picture

Attached is the log file.

AttachmentSize
Log.zip 184.7 KB
Rafeeq's picture

Hi

Delete whatever is inside downloads folder ( Not the download folder)

C:\ProgramData\Symantec\LiveUpdate\Downloads

Follow this docuemnt and try download again

Liveupdate failed and report http 404 error.

http://www.symantec.com/business/support/index?page=content&id=TECH140671
 
Do you have Astro firewall?
 
http://www.symantec.com/business/support/index?page=content&id=TECH146475
 
Check if the LuSesmContentCatalog.xml exists on the server
 
http://www.symantec.com/business/support/index?page=content&id=TECH104249
Hon Kai Chu's picture

Deleted the files but found the links you provided are not for the updates. I used "SebastianZ" method to force update but still get the following error:

"Submission Control Data Error."

"LU1834: LiveUpdate could not find an update file on the server.  Please run LiveUpdate again.  Click here for more information on this error."

I also found in the SEPM "Show Liveupdate Downloads" that the "Submission Control Data" version is 11.0 but not 12.0. Would this be the reason???

SebastianZ's picture

On SEPM these definitions should be listed as "Submission Control Signatures 12.1"

Hon Kai Chu's picture

It only have 11.0. I aslo checked the other SEPM and found "Submission Control Signatures 12.1" which don't excess in this server. Don't know why. This is a new build from the OS!!!!

Hon Kai Chu's picture

Seems like find the solution. When I check the LUA, in the clu-prod I did see the files for the "Submission Control Signatures 12.1" but I can find it in the "clu-test". I copied the files from test to prod in the LUA and go back to the SEPM in the problem server to run the updates again and it updates.

Will monitor for few days before confirming problem solved.

Thanks for the help from all of you!!!!!yes

SOLUTION
SebastianZ's picture

Should be it - previous error was pointing that it could not find the file on the LUA. btw. did not know you were using the clu-test distribution center for SEPM updates.

Hon Kai Chu's picture

I'm using the clu-prod but the files only appeared in the clu-test !!!!

Hon Kai Chu's picture

Monitored for several and it looks good. Problem should be solved. Thank you all !!!!!

Rafeeq's picture

Applu Clu-prod for SEPM.

Clu-test is used for testing. do you really test updates before pushing them?

http://www.symantec.com/business/support/index?pag...

Hon Kai Chu's picture

Understand that. And that's why the SEPM in the same box got no problem. Just don't know when or why those files were gone.

Anyway, will monitor it for few more days and post the result.

Thanks.