Hi All,

After upgrading the clients from 12.1.4 to 12.1.5 we are facing most of the clients showing Virus definition "Not Available".We are using SEPM auto upgrade feature to upgrade the clients and also we set to remove the old settings and logs from clients in clients install settings.

Client OS - Windows 7 64bit.

Thanks in Advance!!!!!

 

Kannan R.

It will be show after some time you can wait some time.

Try to remove one or two client for SEPM console and check again .

You much click LiveUpdate on client to update Virus Definition and all of client content, after that just reboot client, then all problem will be solved.

Were the clients up to date prior to the upgrade? When the client is upgraded it retains those defs so they shouldn't be showing out of date.

Hi Brain,

Yes all the clients are upto date before upgrading.I have tried deleting clients from SEPM console but still it shows as Virus definition "Not Available" and also waited for 2 days no changes.

 

 

If you check a client manually, what does it show?

In client it shows correct definition nut SEPM it shows as Not Available

Clients show green dot? You forced it to check in?

Could be some sort of cosmetic bug, may want to engage support....

Check This articles

Clients cannot send data back to Symantec Endpoint Protection Manager

Article:TECH105348

|

Created: 2008-01-09

|

Updated: 2009-01-30

|

Article URL http://www.symantec.com/docs/TECH105348

Is there any file available at C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\inbox\agentinfo folder?

Yes I'm seeeing .TMP and .ERR files.

1. Browse to \Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\agentinfo

2. Look for any .err files or tmp files & Dat files

3. If you find anything which is not processed by sepm then it might be the reason for the client data loss

4. Stop SEPM services from services.msc

5. Delete all the files inside the location \Program Files\Symantec\Symantec Endpoint Protection Manager\data\inbox\agentinfo

6. Restart the SEPM services.

Check the SEPM now if still issue persist go for step 7

7. Run the Management server configuration wizard.

Ideally there shouldn't be any file present, it means SEPM is not able to process those files.

Stop the SEPM service and delete all the files.

Also if possible reapair the SEPM through add/remove programs.

Is there any update?

Or

If your query has been resolved mark this thread as a solved with the best answer that helps you.

After deleting the files from the  "C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\inbox\agentinfo folder"

Also delete the Clients on the console. It will reappear with correct definition on next heartbeat.

This seems to be an issue with SEP 12.1.5 for some odd reason.  The clients upgrade to 12.1.5 and then they intermittently show in the SEPM with virus definitions "not availabe."  When you check the client side, the SEP GUI will show that it is using the current definitions.  When you check the event logs and SEP logs you will see the following errors: see attachment.  The logs show that the definitions were downloaded and installed, but then the client says they aren't available.  We are seeing this on Windows 7 x64 machines, and our GUPs, which are Server 2008r2.  The only way I've seen to make this start reporting correctly is to perform an smc -stop and then smc -start.  Something is hanging with the sepmasterservice with this version.

 

Here are more screenshots from the SEPM and client side:

 

 

2

3

Very interesting. We are seeing the same thing. Did as James007 suggested and would not and did not repair the SEPM as Chetan suggested. Something definitive needs to be identified as root cause as our SEPM are on 12.1.5 (RU5) with a flux of SEP 12.1 > SEP 12.1.5 reporting endpoints. 

I am having the same issue where non of my clients have been updated since 5/10/2015 and the only way to get them to update is by pushing "fix" on all of the clients. Any suggestions

SEP 12.1 RU6 has been release so I would suggest to upgrade if possible.

Is this a known issue in 12.1.5 because upgrading to 12.1.6 seems to be the solution for everything. and does this mean i have to upgrade all my clients to 12.1.6 also because i just finished getting them upgraded to 12.1.5.

What about enabling sylink logging to see what is going on?

Have you run the symhelp tool on an affected client to see what it shows?

I suspect that if it was a bug there would be a whole lot of people complaining...

Following fix is listed in SEP 12.1 RU6 fix notes.

After upgrading SEPM to 12.1 RU5, 32-bit virus definitions do not update

Fix ID: 3671931

Symptom: After a Symantec Endpoint Protection Manager upgrade to 12.1 RU5, the 32-bit Virus and Spyware definitions are not up to date.

Solution: Gave the semsrv and semwebsrv accounts full access to the LiveUpdate symcData folder.

You need to upgrade SEPM first and need to monitor client status. I don't think you will have to upgrade clients immediately.

Still it's recommended to use both SEPM and SEP clients on the same version.

I tried running the Sylink monitor on a affected machine and nothing happened, not eben when i sent a update policy command. Its like my machines have stopped communicating with the manager. but i will try the symhelp on another machine should I run it on the manager also?

Does the client have the green dot present?

Follow this guide for enabling debugging:

Enable sylink debugging for Endpoint Protection clients

@imfocused, what I do is a Monitors > Log Type > System > Log Content > Client-Activity (log query) and sift through for any glaring errors. Assuming you are at 90 revisions (under SEP 12.1.5 guidance and reasoning) on the SEPM - you should see deltas being downloaded successful. A full.zip from May 10th, 2015 is well under 90 revisions so something is definitely not right. I agree it is draconian to suggest a massive upgrade of all clients to SEP 12.1.6. Your SEPM's yes, reporting clients - no - save a very specific symptom warranting such.

No there is a yellow dot present saying that the definitions are out of date and need to be "fixed"

If you go into Help >> Troubleshooting does it show connected to your SEPM or as offline?

Check

https://www-secure.symantec.com/connect/forums/sepm-1215-client-virus-definitions-not-showing

Thanks @justice I will be looking through the logs to see what I can find.

Hi Kannan R,

As per the latest SEP 12.1 RU6 MP1 fix notes, this was a bug with SEP 12.1 RU5. U

After upgrading to 12.1.5, SEPM Virus Definition column displays “Not Available”

Fix ID: 3783939

Symptom: After you upgrade Symantec Endpoint Protection Manager to 12.1.5 and then click Clients > Group > Clients > Default View, the Virus Definition column displays “Not Available”. The log file vpdebug.log also shows the following error: Unable to retrieve ISavInfo2. Code 0x80040154

Solution: Changed the context so that virus definitions can correctly register with the component services.

Reference: New fixes in Symantec Endpoint Protection 12.1.6.1

• http://www.symantec.com/docs/TECH231856

Please upgrade to SEP 12.1 RU6 MP1 to fix this issue.