Video Screencast Help

SEPM has stopped updating

Created: 25 Feb 2013 | 14 comments
wmujawar's picture

Dear Team,

When i run live update command on My SEPM, i get the result liveupdate succeeded, but the date on the SEPM does not change.

Server has not updated since last 4 days. What can be the issue.

 

Regards,

Wasim Mujawar

Comments 14 CommentsJump to latest comment

.Brian's picture

What is the SEPM version?

Can you try reinstalling LiveUpdate on SEPM

How to Uninstall and Reinstall LiveUpdate on SEPM 12.1 (Enterprise Edition or Small Business Edition)

Article:TECH171060  |  Created: 2011-10-04  |  Updated: 2013-01-02  |  Article URL http://www.symantec.com/docs/TECH171060

 

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Ajit Jha's picture

Any specific error Code while running Liveupdate?

Regard's

Ajit Jha

Technical Consultant

ASC & STS

Ajit Jha's picture

Usually You see the message "LiveUpdate encountered one or more errors. Return code = 4".

This error can be caused for different reasons including, but not limited to, the following:

  1. Internet access is being blocked by a proxy server. (Please see the Technical Information section of this document for steps to configure Liveupdate for use with a proxy)
  2. Symantec Endpoint Protection Manager is trying to connect to an internal LiveUpdate server and the URL supplied to LiveUpdate is not correct.
  3. Enhanced Security is enabled in Internet Explorer (Please see the Technical Information section of this document for steps to disable IE Enhanced Security)
  4. A firewall that requires authentication to get to the internet is used.
  5. The Symantec Endpoint Protection Manager is no longer registered with LiveUpdate.
  6. A Web filtering device detects and blocks certain items.

Note: To re-register the SEPM with LiveUpdate, follow the steps below:

Symantec Endpoint Protection 11.x

  1. Open a command window, then browse to:
    C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin
  2. Type lucatalog -update and press Enter.
  3. Run LiveUpdate to verify that there are no errors.

Symantec Endpoint Protection 12.1

  1. Open a command window, then browse to:
    C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin
  2. Type lucatalog -cleanup and press Enter.
  3. Type lucatalog -forcedupdate and press Enter.
  4. Run LiveUpdate to verify that there are no errors.

Regard's

Ajit Jha

Technical Consultant

ASC & STS

wmujawar's picture

There is no error, infact it says liveupdate successful with return code=0 . Please check the attached screen shot.

 

AttachmentSize
Liveupdate error.docx 129.53 KB
SebastianZ's picture

Check the following folders:

C:\program files\Symantec\symantec endpoint manager\inetpub\content\[definitions subfolder]\[definition revision]

...for the definitions subfolder see on either:

{535CB6A4-441F-4e8a-A897-804CD859100E}: SEPC Virus Definitions Win32 v12.1

or
{07B590B3-9282-482f-BBAA-6D515D385869}: SEPC Virus Definitions Win64 (x64) v12.1

...what is the latest folder you see here?

 

Then check  as well :

C:\ProgramData\Symantec\Definitions\SymcData\spcVirDefs32 and spcVirDefs32 - what is the latest defs subfolder here?

 

wmujawar's picture

Dear Sebastian,

 

The  definitions are the same as :

 

{535CB6A4-441F-4e8a-A897-804CD859100E}: SEPC Virus Definitions Win32

> v12.1

 or

> {07B590B3-9282-482f-BBAA-6D515D385869}: SEPC Virus Definitions Win64

> (x64) v12.1

 

But I cant see the path below:

 

 C:\ProgramData\Symantec\Definitions\SymcData\spcVirDefs32 and

> spcVirDefs32

SebastianZ's picture

What OS is this? Prior to Server 2008 check here:

c:\Program Files\Common Files\Symantec Shared\SymcData\spcVirDefs32 and

> spcVirDefs32

 

Do you find here the same number of revision as in the previous 2 folders?

wmujawar's picture

The OS is win 2008.

rs_cert's picture

Symantec Endpoint Protection Manager (SEPM) 12.1 is not updating 32 or 64 bit virus definitions.

 

Article:TECH166923  |  Created: 2011-08-11  |  Updated: 2012-06-16  |  Article URL http://www.symantec.com/docs/TECH166923

 

Mithun Sanghavi's picture

Hello,

Readers of this Thread may also be interested in:

Symantec Endpoint Protection Manager 11.x is not updating 32 or 64 bit virus definitions.
Article: TECH104721   |  Created: 2008-01-15   |  Updated: 2012-06-16   | 
Article URL http://www.symantec.com/docs/TECH104721

Symantec Endpoint Protection Manager (SEPM) 12.1 is not updating 32 or 64 bit virus definitions.
Article: TECH166923   |  Created: 2011-08-11   |  Updated: 2012-02-06   | 
Article URL http://www.symantec.com/docs/TECH166923

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

Hector.Diaz's picture

I had this happen on two SEPM's, both times I ended up tunning down the number of content revisions to keep to 3.  After a few hours the SEPM's would register the latest definitions then changing the revisions back to a more reliable number. 

 

Neither SEPM was stating it was low on space, it just would not download the definition and not give any specific error.

SameerU's picture

Hi

Please reinstalled the Liveupdate and run manual liveupdate

Regards

 

kaman's picture

Hi

1. Delete the content of folder "C:\Documents and Settings\All users\Application Data\Symantec\LiveUpdate\Downloads\"
Note: Application Data is a hidden folder. Delete the content of the Downloads folder, but not the folder itself.

2. Stop the service "Symantec Endpoint Protection Manager".
To stop this service:

  1. Go to Start > Run.
  2. Type the following: Services.msc
  3. Select and stop the above mentioned service

3. Delete the numbered or TMP folders inside the paths:

  • %programfiles%\symantec\symantec endpoint protection manager\inetpub\content\{535CB6A4-...
  • %programfiles%\symantec\symantec endpoint protection manager\inetpub\content\{07B590B3-...
  • %commonprogramfiles%\Symantec Shared\SymcData\spcVirDef32
  • %commonprogramfiles%\Symantec Shared\SymcData\spcVirDef64

Note 1: In Server 2008, the Downloads folder in step 1 is located at  %programdata%\Symantec\LIveUpdate\Downloads
Note 2: In 64 bit operating systems the "Symantec\Symantec Endpoint Protection Manager\inetpub\content" folder will be located in C:\Program Files (x86) and not C:\Program Files
Note 3: For Windows Server 2008 or similar systems the location of the %commonprogramfiles%\Symantec Shared\SymcData\ will be following: C:\ProgramData\Symantec\Definitions\SymcData\

4. Launch the process LUALL.EXE

5. Restart the Symantec Endpoint Protection Manager service when LiveUpdate is complete. 

  1. Log on to Symantec Endpoint Protection Manager Console and launch a LiveUpdate from Admin > Server > Local Site > Download LiveUpdate content.
  2. Verify the correct download/usage of new virus definitions from "Admin > Server > Local Site >Show LiveUpdate Downloads".