Endpoint Protection

I have SEPM 11.0.5002.333. I have been getting definiton updates from Symantec FTP server at ftp://update.symantec.com/. It's been running fine for years.

This week, SEPM11 LiveUpdate runs without any problem but it has not found any new updates. The latest update found was Monday, May 7, 2012. I know that the most current update is today, May 11, 2012 but our SEPM 11 fails to detect updates after May 7.

I check Log.LiveUpdate file. There seems to be a problem with your FTP server. The folders that LiveUpdate attempts to download updates from do not exist anymore. Here's a partial LiveUpdate log:

5/11/2012, 17:28:54 GMT -> Progress Update: DOWNLOAD_FILE_FINISH: - NOTE - URL: "ftp://update.symantec.com/opt/content/onramp/sesm$20antivirus$20client$20win32_11.0.3001_english_livetri.zip", Full Download Path: "(null)" HR: 0x80072EE3

5/11/2012, 17:28:54 GMT -> Progress Update: DOWNLOAD_BATCH_FINISH: HR: 0x0       , Num Successful: 0

5/11/2012, 17:28:54 GMT -> Progress Update: DOWNLOAD_BATCH_START: Files to download: 1, Estimated total size: 0

5/11/2012, 17:28:54 GMT -> Progress Update: DOWNLOAD_FILE_START: URL: "ftp://update.symantec.com/opt/content/onramp/sesm$20antivirus$20client$20win64_11.0.3001_english_livetri.zip", Estimated Size: 0, Destination Folder: "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads"

5/11/2012, 17:28:56 GMT -> CstInetGetFile::DoTransfer() - InternetOpenUrl returned extended error: 550 /opt/content/onramp/sesm$20antivirus$20client$20win64_11.0.3001_english_livetri.zip: No such file or directory

Please advise what is going on. Thanks.

can you post thw log.liveupdate (complete)?

Hello,

Is the SEPM taking updates from Liveupdate Administrator?

Is there a proxy on the Server?

What happens if you run the Liveupdate from RUN command?

START > RUN > luall.exe

As per the Log, we see..

returned extended error : 550

which tells that it is failing to Retrieve List of Updates. 

However, does not provide a complete idea on what is causing it. Could you upload the entire log.liveupdate to us?

Let us know.

No LU Admin involved. SEPM gets updates directly from Symantec. Our firewall is set to disallow outbound access over HTTP. What normally happens is SEPM attempts to get updates from http://liveupdate.symantecliveupdate.com/ until times out. It fails because our firewall drops outbound HTTP packets. Then SEPM attempts to get updates from Symantec FTP server (ftp://update.symantec.com/) and succeeds. It always succeeds downloading updates from Symantec FTP.

No proxy server either.

Remember this problem just starts earlier this week. I have not touched SEPM for many months. All of a sudden virus defs update stops working. I'd say May 7 or 8 was the last day updates worked.

You guys don't think there's a problem with Symantec FTP??

Attached is Liveupdate log for 1 update session from start to end.

Attachment(s)

lu.txt   363 KB 1 version

can you try reinstalling Liveupdate?

Hello,

Upon checking your Logs, we see the below Errors:

5/11/2012, 17:27:04 GMT -> EVENT - SERVER SELECTION FAILED EVENT - LiveUpdate failed to connect to server liveupdate.symantecliveupdate.com at path  via a HTTP connection. The server connection attempt failed with a return code of 1814, LiveUpdate could not retrieve the catalog file of available Symantec product and component updates.

Suggestions:

You can try the following solutions:

Error: "LU1814: LiveUpdate could not retrieve the update list" (Enterprise)

http://www.symantec.com/business/support/index?page=content&id=TECH101808

Unable to resolve the name of the server. LU1814: "LiveUpdate could not retrieve the catalog file of available Symantec product and component updates"

http://www.symantec.com/business/support/index?page=content&id=TECH94552

How to Uninstall and Reinstall LiveUpdate When a Symantec Endpoint Protection Manager or Symantec Endpoint Protection Client is Installed

http://www.symantec.com/business/support/index?page=content&id=TECH102609&locale=en_US

Hope that helps!!