Server Management Group

Hi there guys,

I'm seeking your technical advice on the "Subject/Title" issue.

Currently, I manage enterprise network with two Endpoint Management Servers plus a Database Server, which serve one thousand one hundred and ninety nine clients. Something strange is happening that some clients aren't receiving updates from the server, therefore they are showing "Virus and Spyware Protection definitions are out of date." 

I've run Live Update from the Management Server to the clients and it showed 100% complete with no change made to client computers.

Thanking you in advance for your support.

Cheers!

Exact version?

If SEP 11.x it is end of support life and no longer gets updates. See here:

https://www-secure.symantec.com/connect/forums/symantec-endpoint-protection-110x-eosl

https://www-secure.symantec.com/connect/blogs/did-you-get-security-memo-symantec-endpoint-protection-11-eosl

If 12.1 you need to enable sylink debugging and post the log here for review:

Enable sylink debugging for Endpoint Protection clients

Many thanks for replying, Brian.

However, my version of SEP is 12.1.4013 and I followed the latter step of enabling sylink debugging for Endpoint Clients but to no avail.

The Windows Definition showed:

and making meaning of it...servers and clients are not receiving the latest definition from Symantec since February 4th, which is why they are showing outdated.

Kindly advise.

Cheers!

Can you post the sylink log from an affected after it has tried to download content?

Also, please run the symhelp tool to troubleshoot the issue, link below on obtaining it:

Download the Symantec Help (SymHelp) diagnostic tool to detect Symantec product issues

http://www.symantec.com/docs/TECH170752

What happens when you run liveupdate on the Management Server?

How to update definitions for the SEPM

1. Log into the SEPM
2. Click on Admin page
3. Click on Servers
4. Click on Local Site
5. Under tasks click Download LiveUpdate Content
6. In the dialog window that pops up click Download
7. When finished, click Close

Are both Management Servers showing as out of date? 

Once restart sepm server and check

Brian, there was no luck enabling sylink debugging on protection clients therefore I cannot upload log files.

The diagnostic result that showed up on SymHelp had to do with maintenance patch and release notes. Refering to the snippet earlier posted above on "Windows Definitions" - Symantec released an update on the 17th of February, 2015 but the management server still had some old definitions since two weeks before latest release; therefore not updating to clients.

I've done LiveUpdate a couple of times successfully and restarted all management servers.

Many thanks for the assist, guys. 

I am going to report this now to our remote enterprise support.

Will be back shortly.

Cheers!

It sounds like you might be getting corrupt virus definitions.  Follow the document below and clear out the definitions on your Management Server.

http://www.symantec.com/docs/TECH166923

I just had this issue on a server and it was due to lack of free space to load the virus definitions. The most recent definitions are taking up over 1.1 gigabytes, so you need a fair ammount of space for the update to occur.

Hi,

check the disk space on your server where contents are downloaded and stored. If the disk space is ok, you may want to revisit your liveupdate policy setup on your primary sepm server. It could be that the sep clients might pointing directly to the LU server over the internet, instead of default management server.

just a suggestion...

sm0kz !!!!