Folks,

I need your help in what could be the problem in my SEPM v 12.1.3 that is not downloading the AV definition daily ?

If I go to the the server through RDP and then run the luall from the star run menu, it works fine, but not when I leave it to do automatically ?

I can see that the following event is logged every hour:

Log Name:      Application
Source:        SescLU
Date:          6/05/2014 11:49:41 AM
Event ID:      13
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SEP-VM.domain.com
Description:

 LiveUpdate returned a non-critical error.  Available content updates may have failed to install.

and the KB article: http://www.symantec.com/business/support/index?page=content&id=TECH105586 is no longer relevant to my case.

How long has this been going on? On changes recently?

Run the symhelp tool on the SEPM

Troubleshooting computer issues with the Symantec Help support tool

Go thru this article as well:

The Symantec Endpoint Protection Manager does not update virus definitions successfully through LiveUpdate

It's been going on since last month.

When I manually initiate LiveUpdate from within the SEPM console, I get:

LiveUpdate encountered one or more errors. Return code = 4

is there anything that I can do to ensure SYmantec Liveupdate working ?

Are you using proxy ?Please post  Log.LiveUpdate ?

See below articles does help you

"Error: LiveUpdate encountered one or more errors. Return code = 4" in LiveUpdate status in Symantec Endpoint Protection Manager

LiveUpdate fails on the Symantec Endpoint Protection Manager with errors in Log.LiveUpdate similar to "LiveUpdate couldn't expand replacement path [spcIronWl-incr-InstallDir]."

Event ID 13: "SescLU - LiveUpdate returned a non-critical error. Available content may have failed to install."

Hi John,

Please check the below article which may help you,

Symantec Endpoint Protection Manager 12.1 is not updating 32-bit or 64-bit virus definitions due to corrupt content

http://www.symantec.com/docs/TECH166923

Thanks,

Bala

Clear the defintion of sepm then try to update

Symantec Endpoint Protection Manager (SEPM) 12.1 is not updating 32 or 64 bit virus definitions.
http://www.symantec.com/docs/TECH166923

Event ID 13: "SescLU - LiveUpdate returned a non-critical error. Available content may have failed to install."

Check this.

https://www-secure.symantec.com/connect/forums/sepm-not-able-download-latest-definition-symantec-site

SEPM cannot download definition from LiveUpdate Administrator 2.2.2.9

http://www.symantec.com/business/support/index?page=content&id=TECH123469&profileURL=https%3A%2F%2Fsymaccount-profile.symantec.com%2FSSO%2Findex.jsp%3FssoID%3D1399353548309HE56oY84RIAHsJ49GYcM8TCm0BIGJ4Sy33gXW

https://www-secure.symantec.com/connect/forums/how-set-sepm-download-definition-liveupdate-administrator

Hi SHukla,

THe SEPM server download the updates directly from the internet not from internal LUA server.

Clean the defintion of sepm..

Hi John,

Please check the flowchart for easy troubleshooting,