Video Screencast Help

SONAR Content Failures exceeds the Maximum Acceptable

Created: 27 Aug 2013 | 11 comments

Hi All,

Someone can help me? I noticed that SONAR Content for many computers are Out-of-date this morning? What is the root cause and how to fix this.

Your prompt feedback will be very appreciate.

Thanks

Operating Systems:

Comments 11 CommentsJump to latest comment

Rash_M's picture

Hi,

Please check the below thread.There was a known issue about this -

Please have a look at this article:

SONAR Definitions are not updated on SEP 12.1 Clients.

http://www.symantec.com/docs/TECH178125

 

Even Try to clean the defintion

How to clear out definitions for a Symantec Endpoint Protection 12.1 client manually
http://www.symantec.com/docs/HOWTO59193

Rafeeq's picture

whats the sonar definition on your SEPM? you can view that under sepm-servers-liveupdate tab

is your sepm getting updates from Luadmin or from internet, if from Luadmin check if you have select SONAR.

 

 
Charry Nsasi's picture

Hi Rafeeq,

The computers up to date have the sonar content bellow :

uptodate1.jpg

The computers out of date have the sonar content bellow:

outofdate1.jpg

Here is the log from server tab:

log1.jpg

Rafeeq's picture

machines which are 8/22 definitions do they get the updates from internet or from SEPM.

Just want to make sure if SEPM indeed downloaded the updates

open Liveudpate policy. on the right hand side you will find Liveupdate content. Select sonar. select use a revision. Do you see 8/22 listed?

Rafeeq's picture

Sylink log would have more info. Enable sylink log and run update policy. post the log here

or run intelligent udpater which will update your sonar defs immediately

http://www.symantec.com/security_response/definitions.jsp

Charry Nsasi's picture

Ok  Rafeeq, i'll do it and revert to you. Big thanks for your assistance.

Charry Nsasi's picture

Hi Rafeeq,

Why i can't see the 'inbox' directory as following paths On the SEP client :

%ALLUSERSPROFILE%\Symantec\Symantec Endpoint Protection\CurrentVersion\inbox  ?

Regards
 

 

Rafeeq's picture

for inbox to appear you need to check " Enable third party content" in Liveudpate policy. Once done that update the policy on the client. it will create that folder

Instead of waiting for it to happen you can create that folder manually.