Video Screencast Help

Why have LiveUpdate Virus Def Downloads increased in size starting Jan 2010 ?

Created: 03 Feb 2010 • Updated: 01 Nov 2010 | 13 comments
Does anyone know why starting in Jan., around the 9th, the size of the SESC Virus Defs W32 V11 downloads using LiveUpdate Administrator started increasing, going from being typically 20M, to averaging over 100M, every day ? Not to mention why it is failing so much.
 
In the past, about 1-3 times a month I would get sizes of 500M, and when I asked Symantec they told me these were Symantec Engine updates, but now for some reason starting last month, every day the sizes are large. This is a problem for me because I have a 5 gig monthly limit, and at the rate of these downloads, I will blow that limit easy and then have to pay .05/Meg, which adds up quickly.
 
I upgraded to the most current LiveUpdate Administrator, 2.2.2.9, hoping maybe that would solve my issue, but nothing has changed. Last night the download was only 74M, but it failed at around 40M, and LUA doesn't have restart capabilities, so if I restart it, it re-downloads what it already had before the failure. Failures happen quite often, sometimes as much at 50% of the time.
 
Here are the downloads since the problem started. Keep in mind every time it fails, it may have downloaded 50, 100, or 400M, just chewing up my monthly allowance.
 
Times are 24H CST
 
02/03 01:02:38-01:16:38   74M     Failed
02/02 01:02:33-01:28:15   154M
02/01 01:02:18-01:24:30   151M
01/31 13:58:12-14:27:10   166M    UPGRADED LUA HERE    Went to other site with un-limited usage in fear of 500M or more file
01/30 19:01:37-19:06:38   160M  
01/30 14:24:16-14:30:34   144M  
01/30 01:02:20-01:19:10   166M    Failed  
01/29 00:03:14-00:38:47   160M    Failed  
01/28 00:07:17-00:42:27   162M
01/27 00:02:59-00:39:09   156M    Failed  
01/26 Disabled
01/25 Disabled
01/24 14:10:06-14:26:18   712M    Went to other site with un-limited usage
01/23 Disabled
01/22 Disabled
01/21 Disabled task because monthly usage is at 50% and have 19 days to go
01/20 00:05:48-00:59:04   725M    Failed  
01/19 00:02:24-00:48:55   247M    Failed  
01/18 00:06:29-00:52:02   195M
01/17 00:02:54-00:48:48   160M    Failed  
01/16 00:06:22-00:46:24   173M    Failed  
01/15 00:02:25-00:13:04   83M
01/14 00:06:35-00:26:44   77M
01/13 00:02:19-00:23:25   84M     Failed
01/12 00:03:13-00:21:35   39M
01/11 00:03:17-00:13:00   38M
01/10 00:03:13-00:24:47   67M
01/09 00:02:28-00:38:01   60M     Failed
01/08 00:05:23-00:17:46   18M
01/07 00:02:24-00:11:02   16M
01/06 00:06:04-00:12:00   21M
01/05 NO UPDATES
01/04 00:06:53-00:14:14   30M
01/03 NO UPDATES
01/02 00:06:00-00:12:37   24M
01/01 00:02:27-00:12:25   26M

Comments 13 CommentsJump to latest comment

Vikram Kumar-SAV to SEP's picture

 As this issue got fixed the size increased. 
https://www-secure.symantec.com/connect/forums/official-status-sepm-definitions-stay-31-12-2009-last-updated-04-jan-2010

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.

sagodar's picture

I'm not sure what you are telling me. Are you saying the size of the downloads will always be large from now on ? If this is the case,  I have to look for a new product.

P_K_'s picture

It may be inter realted with

Title: 'Security Content for Symantec Endpoint Protection clients and Symantec Endpoint Protection Managers are dated Dec 31 2009 even when using the latest definitions'
Document ID: 2010010308571348
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2010010308571348?Open&seg=ent

MCT MCSE-2012 Symantec Technical Specialist (SCTS)

sagodar's picture

I do remember that the first week at least in Jan. the date never changed from 12/31/2009, but that was resolved. All my systems show the most current date for defintions, however in SEPM it still says the "Latest Manager Version" is 2009-12-31 rev. 174. Is this a problem ?

I do appear to have the fix for this on my system, however, I can't be sure, but I think the problem with the sizes increasing may have started about the time the fix was  applied. I'm assuming it part of one of the SESM downloads ? When was the fix available ? Could this have caused the problem ?

Rafeeq's picture

well we had issues with def date and its fixed now,hope the patch is already installed on your environment.

i would suggest you to check only those you require in the downloads section of your LUAdmin.
if you environment dont have 64 bit clients you can skip that download
simillary select your products and what to download.

LiveUpdate Administrator 2.2: What product selections are needed for specific versions of Symantec Endpoint Protection

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/434f5a6ff8750105882574de006badf9?OpenDocument
https://www-secure.symantec.com/connect/forums/lu-admin-and-64-bit-packages

sagodar's picture

The only items I have selected in the Schedule that has increased 8 times over are the following:

SESC Virus Definitions Win32 V11
SESM Virus Definitions Win32 V11

Vikram Kumar-SAV to SEP's picture

 Recently there was also a Scan Engine update..So I think it should get down now..
If its not then it might be some issue with LUA .

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.

sagodar's picture

If you look at my orig post and the download activity, on the 20th the size was over 700MB, so I am assuming that this was the Scan Engine update, which I did finally get downloaded, but the problem started before this, and it has continued even after updating LUA to 2.2.2.9.

Vikram Kumar-SAV to SEP's picture

If there isn't much to configure ( distribution ) why don't you try wiping it out and starting fresh. 

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.

sagodar's picture

Are you talking about just the distribution server ? Why would it cause the downloads to be large ?

Is there an easy way to do that without having to un-install LUA and re-Install it ?

Vikram Kumar-SAV to SEP's picture

 It has nothing to do with distribution list .
Just wanted to say if you do not have much configuration done in LUA then why don't you try re-installing LUA.

So just clear out the downloads then see how it goes
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate Administrator\Download
and
C:\Program Files\Symantec\LiveUpdate Administrator\clu-prod

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.

sagodar's picture

Ok, here is what I did. So I didn't disturb my production LUA Server, I installed LUA 2.2.2.9 on a different machine. I've probably installed LUA a dozen times by now and know that the first time downloading is usually around 500MB. What was interesting this time was that it was actually 1.2GB. And this is only selecting SESC Virus Definitions Win32 V11 and SESM Virus Definitions Win32 V11 .

So, I got the new LUA install primed, distributed the defs and actually configured my prod LUA server to download the defs from that distribution server.

I then did the subsequent downloads for SESC Virus Definitions Win32 V11 and SESM Virus Definitions Win32 V11 from the new LUA server.

They are still 170MB, so I guess this didn't fix the issue.

I need to get this resolved or I will be forced to find a different solution for this site.

There has to be a reason the download sizes for SESC Virus Definitions Win32 V11 and SESM Virus Definitions Win32 V11 have increased from an avg of 20MB to 160-170MB. It started around Jan 9th or so and was before I upgraded LUA.

Is it possible that the code to only select what the user wants is broken and it is downloading a lot more than what I want ?

Vikram Kumar-SAV to SEP's picture

 I would suggest opening up a case with Symantec.

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.