Video Screencast Help
Symantec Secure Login will be live on Connect starting February 25. Get the details here.

How can we check which content SEP 12.1 clients are downloading from GUP?

Created: 25 Apr 2012 • Updated: 25 Apr 2012 | 8 comments
Language Translations
John Q.'s picture
+26 26 Votes
Login to vote

You can find events regarding updates from the GUP by going to Monitors > Logs > Log type: System > Log content: Client activity > View log:

As shown in the screenshot, you can filter it by selecting appropriate event type (Client events) and Event source (SYLINK). You might then save the filter to do not have to configure it everytime.

You might click on Export at the top of the screen to get the results in CSV file, so you would then be able to edit it in Excel, to make a document that would fully match your needs.

Comments 8 CommentsJump to latest comment

TORB's picture

Good tip.

When it comes to content troubleshooting I would recommend using the "System cube" in  IT-analytics. It gives the same data as the monitor, but presented much better.

Login to vote
Mithun Sanghavi's picture


Voted. A Common Question which has been answered beautifully.

Mithun Sanghavi
Associate Security Architect


Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

Login to vote

Thanks for this info as from last two weeks I was working on the same to get this info.

Voted UP.yes



Please don't forget to mark your thread solved with whatever answer helped you.

Login to vote
Ian_C.'s picture

An SQL query that returns the same result can be found here:

Please mark the post that best solves your problem as the answer to this thread.
Login to vote
ajhay.siingh's picture

HI John,
Very useful info by you.thanks. Its useful to monitor GUP download contents..



Login to vote
Marlin's picture

This is good in that it details which content is pulled from what source, but it omits identifying which machine is doing the downloading.

On the other hand, the 12.1 client now has an event log for Symantec Endpoint Protection Client. It will verify that a specific machine has pulled its content update from a GUP, but it doesn't identify which GUP.

Login to vote
John Q.'s picture

You can actually see in the SEPM console which machine is downloading content from the GUP.

The screenshot I put here is a bit too large, but if you copy/paste it into mspaint, you will notice there are few more columns available on the right side of the console, including one showing downloading "Computer" name.

So finally, you can find in this table:

 - Which machine A required content

 - Which GUP was used by A

 - Which file A downloaded from the GUP

Please remember to mark the proper comment as SOLUTION:
 - to identify threads that do not require further assistance
 - to let other visitors know how to fix such issue

Login to vote