Endpoint Protection

I finally upgraded from RU5 to RU6a in anticipation for RU6MP1.  All of my clients are RU5.  SEP clients always installed from SEPM push wizard and not from a GPO. About 85% of my computers auto-upgraded just fine.  On the ones that don't upgrade, the SEP_INST.LOG file is dated back to last year when we rolled out RU5.  The files locally on the client in the clnt-inst folder are RU5.  Clients are communication with the SEPM and are getting current definition updates.  Green dots everywhere (server console and client).  Clients are in different groups, but the polices, communication setting, practically all configuration is the same for all groups.

Working with tech support, we went from pull mode, 60 minutes to push, 5 minutes.  Server -> issued update content, client -> ran "update policy".  Nothing worked.  He even looked at my SYLINK logs that I captured from the monitor program.  Does anyone have any advice other than pushing out the client to these computers?

Symantec case # 412654871

Could you please post the  sylink.log file from a client?

 

Hi Rick, 

Have you tried attaching a install package in the SEPM? I have come across problems with the push deployment wizard not updating clients. What I tend to do is use clientremote.exe on most clients (to help with bandwidth) and then attaching the install package in the SEPM, to update the rest. Just a thought. 

Mike 

@postechgeek - I'm using the auto upgrade feature in SEPM where you add install packages to groups.  This is the problem, most client are upgraded automatically, but some do not.  I don't want to have to resort to using the push install (clientremote) since that would clog up my bandwidth even more than using install packages (according to the symantec tech I spoke to).

Hi RickJDS,

To add the  install  package  to a group, go to SEPM-Clients- and  select  the  group where  your  clients are. Select, Install  packages  tab on right. Click on ADD, and  add the  version you  want  to upgrade  to, and  click OK.

Note: If you already  see an older  package  added to the group, delete that before  adding the new  one.

Vishal, that is *exactly* what I'm doing!

Here's the sylink log from the SEPM, also of note, the SEP client on the SEPM did not auto-upgrade either.

Please enable the IIS logs on the SEPM server. To do this, go to the properties of each Virtual directory in IIS,  under  Symantec Web server, and check the box, log  visits. See the attached screen shot , for one Virtual directory...

to find out the  file name, and  location, of the  IIS logs, go to the  Symantec Web server  properties, and click on properties. See the attached screen shot.

Please  upload the logs....after  about 10 minutes....so that  sufficient  logs  are  generated

 

Here's the IIS log:

The Symantec tech on the phone had me enable an upgrade schedule (8:30am to 8:30am) and now it appears the clients that have not upgraded are upgrading!

That's kool then............:-)

Well, 7 out of 10 online clients upgraded.  I'm not sure why the other three did not upgrade.

Could you  please  get  me  the  install log  from one on which it did not work, now? And also the  IIS logs, now?

One required a reboot.  I've attached the installation log from a Windows 7 x64 that won't upgrade.  The last one is the SEPM server, the client installation log is still dated back to when RU5 was installed.

Thanks to the tech on the phone for being so patient and answering my thousands of questions!  A while back, on another support call, the tech person had me change my communication settings to pull with a 60 minute heartbeat.  Why?  No idea. 

I changed it back to push with a 5 minute heartbeat since my SEPM is a Windows server.  Ran the command to update content on all groups and now everything is going as it should.  I'm at about 90% complete for upgrading my clients to RU6A.

Nice!

using the same time on both will force immediate updates.
Setting them a few hours apart will spread the updates over that time.
The first is like pusing to ALL clients at one time.
The second spreads the load and updates them at random during the time period specified.
HOWEVER, I've used BOTH and STILL find that some simply don't update/upgrade until I push using the tool.
There's always a few that until you reboot them, or use a push install, they just won't use that "assigned" upgrade method.
It's actually a small, but still frustrating amount.
I don't know WHY that using the "do it ALL NOW" approach works better than spreading it say, from 6pm to 5am over several hours, but it does.