Video Screencast Help

SONAR content is not updating

Created: 09 Apr 2012 | 6 comments


In some of client machines the SONAR content is not updating properly,so in Symantec Console, error is showing.Please find the attachment for eroor in symantec console.Request you to do the needful for the same.

Comments 6 CommentsJump to latest comment

Ajit Jha's picture


1. Change the Communication Mode from Push to Pull. 

  •  Open the SEPM console and in the Clients section (Computers section on small business edition), choose My Company or a client group that doesn't inherit policies from My Company.
  •  On the right side of the console go to the Policies tab.
  •  On the far right, click on Communications Settings.
  •  If the Download is set to Push mode, change it to Pull mode.
  •  Set the heartbeat interval to something appropriate for the size of the network, which could be from 15 minutes to a few hours.

2.  Roll back the SONAR definitions to an older set.

  •  In the Policies section of the manager, highlight LiveUpdate.
  •  Select the LiveUpdate content tab, and edit the LiveUpdate Content policy.
  •  Under Security Definitions, use the radio button under SONAR heuristic signatures to Select a revision.
  •  Use the edit button to select an older revision for SONAR Heuristics engine 12.1 than is currently in use.
  •   Make sure that the policy is assigned to all groups and that they update with the policy.
  •  The policy serial number has the date and time of the last change and that can be seen in Monitors - Logs - Computer Status, or in the Client Status view in the client group.


Ajit Jha

Technical Consultant


pete_4u2002's picture

are other module updated?

can you pass on the sylink log?

Mohan G kumar's picture

Other then SONAR AV and PTP and NTP are up to date but SONAR not updating

Sayan's picture

Folow the article posted by Ajit and have a look on my attachment too.

article image1.jpg
Mithun Sanghavi's picture


What version of SEP 12.1 are you carrying? Is that SEP 12.1.1000 (RU1)?

If not, I would recommend you to Migrate to the Latest version of SEP 12.1 RU1 as there are couple of fixes done in the Latest version. Check this Article:

New fixes and features in Symantec Endpoint Protection 12.1 Release Update 1

Again, you could also check this Article: SONAR Definitions are not updated on SEP 12.1 Clients.

Secondly, Are the clients updated? What is the date format selected?

Check this Article:

Hope that helps!!

Mithun Sanghavi
Associate Security Architect


Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.