Endpoint Protection

Environment - Window 7 SP1 Professional, SEP 12.1.4 unmanaged client

We are looking for a solution, please do not tell us to run SymDiag, reinstall or update to the latest unless you absolutely know it will fix the problem.

We have several unmanaged clients.  Everything was working fine at close of business last week.  Nothing has changed.

Today we get an error when running  a manual LiveUpdate on the unmanaged clients.

from LiveUpdate:

Encountered an error while downloading file

sesc$20antivirus$20client$20win64_12.1_english_livetri.zip

Is there something going on with the Symantec LiveUpdate servers?   Managed clients may not be seeing this error.

Thanks,

Wally

Did you review the Log.Lue log file on the affected client to see if there are any additional errors or information in it?

SymDiag doesn't fix anything. One of its functions is to check the client for issues. So that may be worth doing unless it's difficult to do in your environment.

We looked at the Log.Lue log file and saw the same error as reported by the client UI.  LU is trying to download from liveupdate.symantecliveupdate.com.

LU retries the download six times and then issues *Failed download for file sesc$20antivirus$20client$20win64_12.1_english_livetri.zip".  No other indicatons of errors.

The next entry in Log.Lue is interesting:

Adding an update to potentially available list by catalogue parser:  SEPC Virus Definitions Win64 (x64) 12.1 RU2 H, MicroDefsB.Curdefs, SymAll Languages, CurDefs, 170717008.

***** Session Results *****

Total Updates Available:  1

Total Updates Succeeded: 1

Total Updates Succeeded - Reboot Req:  0

Total Updates Skipped: 0

Total Updates Failed: 0

Session result code: 0x00000000

There's nothing wrong with the client.   We think it's on Symantec's end.

They'll need to confirm. Either open a case with them or hopefully someone from Symantec will check this thread.

To add to this:

I checked my 14 MP1 unmanaged client and it is showing the same error. 

Symantec support should be engaged.

Thanks Brian.  It's been a long time, but we've seen things like this before with unmanaged clients..  There is absolutely nothing wrong on this end.   We updated the defs a couple of days ago with out any problems at all.   We came in to the office this morning, and this is the first thing we encountered after booting up the machines.

Managed clients don't seem to have problems of this sort.

We opened a case a few minutes ago.

Wally

Looking forward to seeing what the issue (and resolution) is now that I see it as well.

-Brian

Our Symantec contact advised us that there was something wrong with the 07/17/2017 content that was published.  Evidently they had multiple customers experiencing the same issue.

Apparently the content was corrected overnight.  We downloaded the new content this am, 07/18/2017, and it had no problems.

I've closed our case with Symantec.

Do you know if Symantec publishes alerts or anything like that for issues with their LiveUpdate servers?  We know this issue doesn't happen very often, but when it does we don't have a simple way to tell if it is something broken on our end or a Symantec issue.

Wally wrote:

"Do you know if Symantec publishes alerts or anything like that for issues with their LiveUpdate servers?  We know this issue doesn't happen very often, but when it does we don't have a simple way to tell if it is something broken on our end or a Symantec issue."

I think Wally makes a valid point.  Often we have to wait for, or search for,  a technical bulletin addressing an issue OR wait until someone from Symantec makes an official statement on the forums about the problem. An alert page  we could check as needed would be great. Also, it would probably cut down on the number of support cases filed for a known issue.  Obviously, someone will open a support case on a new problem and Symantec will investigate.  If Symantec finds an issue to be global or common, an alert area would be ideal.

CQ

Closest I've found:

https://status.symantec.com/

It doesn't address this particular issue, but, perhaps adding LU server issues is a viable optionat some point.