Why do we get different results on virus definitions eventhough the interval was just a second or so?
Updated: 21 May 2010 | 19 comments
This issue has been solved. See solution.
Hi Team,
Please kindly reply why we get different results on virus definitions eventhough the interval was just a second or so.
How fast could the SEPv11 parent server recieve the polls coming from each client?
What is its default settings?
Many thanks,
Nel Ramos
IT-OCC
Etelecare Global Solutions
discussion Filed Under:
Comments
The standard practice is to
The standard practice is to have the updates at least 1/day. You can also check the action if the first action to update failed at that time.
“Your most unhappy customers are your greatest source of learning.”
Polls between client and
Polls between client and server are typically once in 4 hours. These are customizable in the configs. The polling interval difference varies from client to client resulting in different revisions of definitions in clients
The problem with the polling
The problem with the polling is that some clients somewhat get the special treatment getting updates often and the others haven't got one in weeks.
“Your most unhappy customers are your greatest source of learning.”
If the polls are 4 hours
If the polls are 4 hours apart then how come we get different results in 10 seconds interval?
Is there a way to make the results more stable?
thanks.
Nel Ramos
what are the different results
what are the different results look like, are they of different dates or of different revisions?
...
I'm assuming that your clients have different revision dates. SEP uses 2 different policies on updating. One defines the server and frequency to check for updates and the other defines which updates is to be distributed. This can only be done on the server side. Clients only have the LiveUpdate option that will get the updates when you click on it. This is not a polling issue by the SEP, but rather, based on the time the clients connect to the server and if they managed to connect at that time or if it is in use by other clients which would then terminate the session for the former and go on a "standby". Do you have other servers rarely used that can serve as GUP?
My suggestion is to try the 2nd option in the policy or setup a GUP (Group Update Provide). The only drawback for the 2nd option is when there is an immediate need for a rapid release and it would consume a lot of bandwith or just update select clients that was connected at the time. On the plus side, at least the clients would have definitions not older than 2 days which is better than having a mix of updated clients and non-updating clients.
More info is found on the admin guide starting at page 107.
“Your most unhappy customers are your greatest source of learning.”
Hi Sapta, I thinks not in
Hi Sapta,
I thinks not in dates or revisions but by the number of computers visible at the time.
Several computers were not found on each report.
It looks like that they are either turned off or got disconnected.
But how come they change so quickly in a matter of seconds?
Thanks.
Nel Ramos
IT-OCC
Etelecare Global Solutions
Nel Ramos
Hi Ramon, That might work. We
Hi Ramon,
That might work.
We shall study on having that in the nearest future.
How big is the number of clients that could connect to the SEPv11 server at one time?
Would the clients tend to re-connect for several times before termination?
Do we have a default on this Sirs?
Many thanks.
Nel Ramos
IT-OCC
Etelecare Global Solutions
Nel Ramos
Connection (Actual)
I checked the server with a GUI netstat. The number of connections at that time was 941 (established and time wait combined) and 911 unique PCs. Only 6 were established at the time. The rest is either waiting to connect or waiting to time_out.
“Your most unhappy customers are your greatest source of learning.”
Are you in Push or Pull mode?
Are you in Push or Pull mode? I suspect Push will have so many concurrent connections that some clients will suffer. Pull will allow the client to poll the server and drop the connection, freeing up resources for the remaining clients as they poll.
I can't confirm this but it
I can't confirm this but it is currently in pull mode if that's the default.
“Your most unhappy customers are your greatest source of learning.”
Push mode is the default one
Push mode is the default one i think
Nel, could you post the
Nel, could you post the update settings from the server.
“Your most unhappy customers are your greatest source of learning.”
Default shows that I need to
Default shows that I need to "specify how often to schedule clients to run LiveUpdate and check for and download the lates updates." Frequency is defined at a specific number of hours. Retrying every hour.
Randomized +- number of hours.
Best Regards,
Nel Ramos
Nel Ramos
Try this
Try setting it to update only 1/day and or 2x a day. Randomize it between 2~3 hours and keep trying for 4 hours.
This won't have any noticeable effect on the bandwidth usage if it's just in time_wait status.
“Your most unhappy customers are your greatest source of learning.”
Thanks Mon. It worked. We
Thanks Mon.
It worked.
We had increased the update settings a little higher.
thanks.
Nel Ramos
Thanks Mon for solving the
Thanks Mon for solving the issue..
I had learned a lot...
Your the solution!!! your the
Your the solution!!! your the man MON!!!
Thanks guys. :D Glad to
Thanks guys. :D
Glad to help/be of service.
“Your most unhappy customers are your greatest source of learning.”
Would you like to reply?
Login or Register to post your comment.