Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

Why do we get different results on virus definitions eventhough the interval was just a second or so?

Updated: 21 May 2010 | 19 comments
Nel Ramos's picture
+3 3 Votes
Login to vote
This issue has been solved. See solution.

Hi Team,

Please kindly reply why we get different results on virus definitions eventhough the interval was just a second or so.
How fast could the SEPv11 parent server recieve the polls coming from each client?
What is its default settings?

Many thanks,

Nel Ramos
IT-OCC
Etelecare Global Solutions

Comments

mon_raralio's picture
22
Apr
2009
1 Vote +1
Login to vote

The standard practice is to

The standard practice is to have the updates at least 1/day. You can also check the action if the first action to update failed at that time.

“Your most unhappy customers are your greatest source of learning.”

vikram3500's picture
22
Apr
2009
1 Vote +1
Login to vote

 Polls between client and

 Polls between client and server are typically once in 4 hours. These are customizable in the configs. The polling interval difference varies from client to client resulting in different revisions of definitions in clients

mon_raralio's picture
22
Apr
2009
1 Vote +1
Login to vote

The problem with the polling

The problem with the polling is that some clients somewhat get the special treatment getting updates often and the others haven't got one in weeks.

“Your most unhappy customers are your greatest source of learning.”

Nel Ramos's picture
22
Apr
2009
2 Votes +2
Login to vote

If the polls are 4 hours

If the polls are 4 hours apart then how come we get different results in 10 seconds interval?
Is there a way to make the results more stable?

thanks.

Nel Ramos

Sapta's picture
23
Apr
2009
0 Votes 0
Login to vote

what are the different results

what are the different results look like, are they of different dates or of different revisions?

mon_raralio's picture
23
Apr
2009
2 Votes +2
Login to vote

...

I'm assuming that your clients have different revision dates. SEP uses 2 different policies on updating. One defines the server and frequency to check for updates and the other defines which updates is to be distributed. This can only be done on the server side. Clients only have the LiveUpdate option that will get the updates when you click on it. This is not a polling issue by the SEP, but rather, based on the time the clients connect to the server and if they managed to connect at that time or if it is in use by other clients which would then terminate the session for the former and go on a "standby". Do you have other servers rarely used that can serve as GUP?

My suggestion is to try the 2nd option in the policy or setup a GUP (Group Update Provide). The only drawback for the 2nd option is when there is an immediate need for a rapid release and it would consume a lot of bandwith or just update select clients that was connected at the time. On the plus side, at least the clients would have definitions not older than 2 days which is better than having a mix of updated clients and non-updating clients.

More info is found on the admin guide starting at page 107.

“Your most unhappy customers are your greatest source of learning.”

Nel Ramos's picture
23
Apr
2009
2 Votes +2
Login to vote

Hi Sapta, I thinks not in

Hi Sapta,

I thinks not in dates or revisions but by the number of computers visible at the time.
Several computers were not found on each report.
It looks like that they are either turned off or got disconnected.
But how come they change so quickly in a matter of seconds?

Thanks.

Nel Ramos
IT-OCC
Etelecare Global Solutions

Nel Ramos

Nel Ramos's picture
23
Apr
2009
2 Votes +2
Login to vote

Hi Ramon, That might work. We

Hi Ramon,

That might work.
We shall study on having that in the nearest future.

How big is the number of clients that could connect to the SEPv11 server at one time?
Would the clients tend to re-connect for several times before termination?
Do we have a default on this Sirs?

Many thanks.

Nel Ramos
IT-OCC
Etelecare Global Solutions

Nel Ramos

mon_raralio's picture
24
Apr
2009
1 Vote +1
Login to vote

Connection (Actual)

I checked the server with a GUI netstat. The number of connections at that time was 941 (established and time wait combined) and 911 unique PCs. Only 6 were established at the time. The rest is either waiting to connect or waiting to time_out.

“Your most unhappy customers are your greatest source of learning.”

dgh's picture
24
Apr
2009
1 Vote +1
Login to vote

Are you in Push or Pull mode?

Are you in Push or Pull mode? I suspect Push will have so many concurrent connections that some clients will suffer. Pull will allow the client to poll the server and drop the connection, freeing up resources for the remaining clients as they poll.

mon_raralio's picture
25
Apr
2009
1 Vote +1
Login to vote

I can't confirm this but it

I can't confirm this but it is currently in pull mode if that's the default.

“Your most unhappy customers are your greatest source of learning.”

Bijay.Swain's picture
25
Apr
2009
1 Vote +1
Login to vote

Push mode is the default one

Push mode is the default one i think

mon_raralio's picture
25
Apr
2009
0 Votes 0
Login to vote

Nel, could you post the

Nel, could you post the update settings from the server.

“Your most unhappy customers are your greatest source of learning.”

Nel Ramos's picture
26
Apr
2009
2 Votes +2
Login to vote

Default shows that I need to

Default shows that I need to "specify how often to schedule clients to run LiveUpdate and check for and download the lates updates." Frequency is defined at a specific number of hours. Retrying every hour.
Randomized +- number of hours.

Best Regards,

Nel Ramos

Nel Ramos

mon_raralio's picture
26
Apr
2009
2 Votes +2
Login to vote

Try this

Try setting it to update only 1/day and or 2x a day. Randomize it between 2~3 hours and keep trying for 4 hours.
This won't have any noticeable effect on the bandwidth usage if it's just in time_wait status.

“Your most unhappy customers are your greatest source of learning.”

Nel Ramos's picture
30
Apr
2009
3 Votes +3
Login to vote

Thanks Mon. It worked. We

Thanks Mon.
It worked.
We had increased the update settings a little higher.
thanks. 

Nel Ramos

Amihan's picture
18
Jun
2009
4 Votes +4
Login to vote

Thanks Mon for solving the

Thanks Mon for solving the issue..
I had learned a lot...

Kadoneng's picture
01
Jul
2009
3 Votes +3
Login to vote

Your the solution!!! your the

Your the solution!!! your the man MON!!!

mon_raralio's picture
02
Jul
2009
1 Vote +1
Login to vote

Thanks guys. :D Glad to

Thanks guys. :D
Glad to help/be of service.

“Your most unhappy customers are your greatest source of learning.”