Endpoint Protection

HI

I am troubleshooting some clients which are not updating from the gup, here's what's happening:

1. I can't find any usual lines like <GetLUFileRequest:>

      2.When I search for the port 2967 all i get is this:

2016/09/21 16:37:05.218 [7380:5228] GUProxy - MasterClientBypassTime [-1], MasterClientThreadCount [10], MasterClientMaxDiskCache [500], MasterClientDeleteUnusedContentsTime [1728000], MasterClientThrottling [512], ClientThrottling [-1], MasterClientPort [2967], Enable Pre-defined GUP [1], Enable Dynamic GUP [0], Enable Explicit GUP mappings [0]

     3. I can telnet to the gup on port 2967 fine.

     4. The gup has enough space upto 2000MB set for the content files

Yet clients have not updated and their definitions are at sep 16.

How can i debug this further and what should i look for?

Appreciate all the help

Regards

https://support.symantec.com/en_US/article.TECH104539.html

many examples

I have seen that page already.

I can telnet to the GUP.

Other than I do not see any of those logs life LUThreadProc etc in the log.

Could it be that I need to let the log run for longer or something? I enabled debug log and set it to 10000kb and updated the policy from the sep client but nothing in the logs relating to GUPs!

HI

This piece of log says gup 10.x.x.227 chosen, but that machine is NOT SET as GUP and nor can I telnet to it on 2967.

This is the log for my own machine.

Should i hiding my internal pvt ip? Just feeling paranoid I guess!

2016/09/27 07:22:04.561 [7388:7488] GUProxy: Final candidate list:
2016/09/27 07:22:04.561 [7388:7488] GUProxy: 10.x.X.227
2016/09/27 07:22:04.561 [7388:7488] GUProxy: 10.x.x.232
2016/09/27 07:22:04.561 [7388:7488] CAsyncHttpConnection::Close - Request: InternetReadFileEx; CtrlBlk: 0362BF50 time: 0
2016/09/27 07:22:04.561 [7388:7488] SyLinkEventFunc - EVENT_LU_REQUIRE_STATUS: Calling QueryContentSeqData with Moniker: {810D5A61-809F-49c2-BD75-177F0647D2BA} Target Sequence: 160926008
2016/09/27 07:22:04.561 [7388:7488] LuMan: Entering QueryContentSeqData: {810D5A61-809F-49c2-BD75-177F0647D2BA}, 160926008
2016/09/27 07:22:04.561 [7388:7488] LuMan: QueryContentSeqData result: 0x20010006
2016/09/27 07:22:04.561 [7388:7488] LuMan: QueryContentSeqData cached sequence: 160926002
2016/09/27 07:22:04.561 [7388:7488] SyLinkEventFunc - EVENT_LU_REQUIRE_STATUS: QueryContentSeqData returned CMC_CONTENTUPDATE_NEEDED(536936454)
2016/09/27 07:22:04.561 [7388:7488] SyLinkEventFunc - EVENT_LU_REQUIRE_STATUS: No cached content information was returned. Request full package
2016/09/27 07:22:04.561 [7388:7488] GUProxy: Current GUP 10.X.X.227 staus is 1
2016/09/27 07:22:04.561 [7388:7488] GUProxy: GUP 10.X.X.227 chosen
2016/09/27 07:22:04.592 [7388:7488] AH: Setting the Browser Session end option & Resetting the URL session ..
2016/09/27 07:22:04.701 [7388:7488] SyLinkEventFunc - EVENT_LU_DOWNLOAD_COMPLETED: Calling ApplyContent with Moniker: {810D5A61-809F-49c2-BD75-177F0647D2BA} Package Type: 7 Base Sequence: 160926002 Target Sequence: 160926008 Path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.6867.6400.105\SmcLu\content.zip
2016/09/27 07:22:04.701 [7388:7488] LuMan: Entering ApplyContent: {810D5A61-809F-49c2-BD75-177F0647D2BA}, 160926008, 7, 160926002
2016/09/27 07:22:05.106 [7388:7488] LuMan: ApplyContent result: 0x00000000, DURESULT: 9
2016/09/27 07:22:05.200 [7388:7488] LUMan: Call to LueSupportedContent::Initialize returned success in ApplyContent.
2016/09/27 07:22:05.215 [7388:7488] SyLinkEventFunc - EVENT_LU_DOWNLOAD_COMPLETED: ApplyContent returned unknown code(0)
2016/09/27 07:22:06.073 [7388:7488] GUProxy: SetDownloadStatus for /content/{810D5A61-809F-49c2-BD75-177F0647D2BA}/160926002/xdelta160926002_To_160926008.dax status 1
2016/09/27 07:22:06.073 [7388:7488] GUProxy: to set status 1 for 10.x.x.227