Endpoint Protection

Hello to all the Gurus of SEPM and GUP. I am facing an issue of full content downloads on clients from GUPs and SEPM. I would really appreciate if can the community can help and guide me. I have already a case open with Symantec on this but still haven't found a fix for it yet. Here is the scenerio. 

Number of GUPs = 2 

SEPMs = 2

Version on Endpoints, GUP and SEPMs= 12.1.5 (RU5) 

Basically what is happening is clients that are running older AV definations (3-4 weeks old)  are failing to download AV definations full.zip neither from SEPM nor GUPs. Though they are able to download AV delta upgrades from SEPMs and GUPs but whenever the endpoints try to download full.zip AV defs they always fail.

Endpoints are updated and can download delta upgrades for AV,PTP and NTP but whenever they try to download full.zip it fails and as a result on endpoints in AV def date " Not Available " is seen.

Now for some of the endpoints if I try to search any logs for them on SEPM , I could not retrive any info back and some of the endpoints in SEPM console client tab I do not see any policy serial number with clients

I am attaching the lsylink ogs and screenshots for your reference. Kindly advise and suggest. Thanks and Regards

Attachment(s)

AdeelZakir Av.txt   137 KB 1 version

asadsylnk.txt   185 KB 1 version

Faisal Illahi AV Sylink Report.txt   98 KB 1 version

What do you have the GUP cache set to? default is 500MB which is not enough

It's trying to download over 600mb

[Content]<LUDownloader::DownloadFile>  Source Path: /content/{07B590B3-9282-482f-BBAA-6D515D385869}/150224048/Full.zip Target Path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\LiveUpdate\LUF{07B590B3-9282-482f-BBAA-6D515D385869}1502240481.TMP Target Size: 616688073

2 GB

Have already run a repair on SEPM and purged the AV Defs

Even if the endpoints try to get the full.zip from SEPM they fail

Cache on GUPs set to 2 GB

would really appreciate if I can have some inputs and suggestions on this 

I would like you to follow these steps

do a tracert SEPMServer

does it go through proxy / firewall?

Download psexec ( sys internal tools)

Open IE as System account. 

try downloading

http://vm-av-pri.cmpak.local:8014/content/{07B590B3-9282-482f-BBAA-6D515D385869}/150224048/Full.zip

does that complete or throw some error, all I can say is its getting blocked in your network.

do you use multiple GUP ?

Where are you seeing the full.zip download fail? In the second, it shows succesfully downloading.

rafeeq tracert to SEPM from where ? endpoints in remote sites or local sites ?

should i try to download it and type that in on the SEPM machine it self or the endpoints ?

Secondly both the endpoints and GUP-1 are in same city

endpoints and GUP-2 are in the same city

endpoints and SEPM are in same city

if it is really getting blocked by the network any way I can confirm if it is really getting blocked in the network ? Regards

Did you run SymHelp on the SEPM to check for corrupt definitions? It's not very likely (deltas are ok) but you never know ...

tracert will tell how what path your client is taking to reach SEPM.

do a tracert from client, same city is different from same subnet it has to take a path to reach SEPM.

have a check on that.

Greg like I have said , we have already purged and re-downloaded the defs on SEPM servers 

Alright Rafeeq I will check that aspect as well , what exact thing you want me to check in tracert if the clients are reaching the SEPM ?

apart from this any other thing or setting you want me to verify ? 

Hello pete I am using multiple GUPs with explicit subnet mappings

Hello Brian it was able to download full.zip once in 3 days , the majority of clients running older defs 3 - 4 weeks are failing to grab full.zip neither from SEPM nor GUPs , this is what I am seeing in logs on the SEPM that when endppoints try to download full.zip either from GUPs or SEPM it fails 

BTW today I have also increased the content revisions to 90

any suggestions ?

Did increasing to 90 days help out at all?

Do clients that had relatively new content revisions still update? Or are none of the clients updating at all regardless of content date?

Did you make any change in apache mod files for bandwith ?

Brian clients are getting delta upgrades fine , its just the full.zip that is causing the problems for example if client is keeping 3-4 weeks old def then it will try to grab full.zip either from SEPM or GUPs but fails.

I increased the revisions to 90 today which was set to 30 earlier. majority of the endpoints download the deltas fine and are at 2-3 days behind i.e the last one at 22-21 feb. However those that needs full.zip always fail when they try to download like you see in the sylink logs attached for few endpoints

no rafeeq havent made any change like that , like I told you has already a case open with Symantec on this , been 2 days no fix yet 

any update ?

can you share us sylink.log from both GUP and client affected

based on the log we can know if it's a known issue in RU5....

cus000 sylink files are already attached with the thread

Sorry didn't notice.... found error below

you may check n try the solution in this thread

https://www-secure.symantec.com/connect/forums/sep-update-fails-even-after-telnet-gup-successful




02/24 15:09:02.256 [9276] <CHttpConnector::SendRequest()>
02/24 15:09:02.256 [9276] Request> http://172.25.200.136:8014/content/{07B590B3-9282-482f-BBAA-6D515D385869}/150223019/Full.zip
02/24 15:09:02.381 [9276] Unable to query return content length for SendRequest, 122
02/24 15:09:02.381 [9276] </CHttpConnector::SendRequest()>
02/24 15:09:02.381 [9276] <CHttpFileDownload::read()>
02/24 15:09:58.931 [8096] <CSyLink::mfn_DownloadNow()>
02/24 15:09:58.931 [8096] </CSyLink::mfn_DownloadNow()>
02/24 15:10:59.569 [8096] <CSyLink::mfn_DownloadNow()>
02/24 15:10:59.569 [8096] </CSyLink::mfn_DownloadNow()>
02/24 15:12:00.207 [8096] <CSyLink::mfn_DownloadNow()>
02/24 15:12:00.207 [8096] </CSyLink::mfn_DownloadNow()>
02/24 15:13:00.844 [8096] <CSyLink::mfn_DownloadNow()>
02/24 15:13:00.844 [8096] </CSyLink::mfn_DownloadNow()>
02/24 15:14:01.482 [8096] <CSyLink::mfn_DownloadNow()>
02/24 15:14:01.482 [8096] </CSyLink::mfn_DownloadNow()>
02/24 15:15:02.119 [8096] <CSyLink::mfn_DownloadNow()>
02/24 15:15:02.119 [8096] </CSyLink::mfn_DownloadNow()>
02/24 15:16:02.409 [8096] <CSyLink::mfn_DownloadNow()>
02/24 15:16:02.409 [8096] </CSyLink::mfn_DownloadNow()>
02/24 15:17:03.048 [8096] <CSyLink::mfn_DownloadNow()>
02/24 15:17:03.048 [8096] </CSyLink::mfn_DownloadNow()>
02/24 15:17:42.675 [9276] </CHttpFileDownload::read()>
02/24 15:17:42.800 [9276] </CHttpFileDownload::Do()>

Hello Cus , I am not seeing HTTP error 407 , is it also applicable in my scenerio ?

cus000 I have already tried to the steps mentioned in the article didn't do any good

Can u send debug log from GUPs?
 

Hello everyone , please find attached the debug logs for  GUP server to see if there is any issue or bug with this version or what excatly is causing this. Thanks in advance

Attachment(s)

south gup.txt   127 KB 1 version

Also ran SymHelp tool on both SEPMs it didn't show any error

Here is the Debug log for the second GUP server 

Attachment(s)

debug central.txt   106 KB 1 version