Endpoint Protection

 View Only
  • 1.  SEP 12.1.4 IPS LiveUpdateError

    Posted Sep 24, 2017 09:03 PM

    Environment:  Windows 7 SP1 Professional 64-bit

    SEP 12.1.4 - UNmanaged clients

    We are looking for a solution, please do not tell us to run SymDiag, or reinstall/update to the latest unless you absolutely know it will fix the problem.

    Beginning Friday, September 22, 2017, we started getting an error on ALL clients when downloading the 170922012 IPS def update.  The error is "An update for Intrusion Prevention Signatures from LiveUpdate failed to install.  Error: Postsession callback failed (208)."   We are downloading directly from the Symantec LiveUpdate server at liveupdate.symantecliveupdate.com.  Nothing has changed in our environment

    We can manually run LiveUpdate from the client UI a second time and the IPS update is successful.

    What exactly is a "Postsession callback failed (208)" error?   Has anyone else experienced this problem with the 09/22/17 r12 IPS defs? 

    We're assuming that there is a Symantec issue with the 09/22/17 r12 IPS defs since it's happening on all machines. 

    Absolutely nothing has changed in our environment.

    Hopefully someone from Symantec will see this and investigate.

     



  • 2.  RE: SEP 12.1.4 IPS LiveUpdateError

    Posted Sep 24, 2017 09:06 PM

    Symantec has been having issues with some IPS updates lately so this could fall under that. Get a case opened up so they can start root cause analysis.



  • 3.  RE: SEP 12.1.4 IPS LiveUpdateError

    Posted Sep 24, 2017 09:14 PM

    Thanks Brian.   LliveUpdate issues seem to be happening more frequently lately for both AV and IPS defs - maybe once a month.  Seems to occur during Friday-Monday time frame.

    What's going on?



  • 4.  RE: SEP 12.1.4 IPS LiveUpdateError

    Posted Sep 24, 2017 09:15 PM

    I can't answer for Symantec.



  • 5.  RE: SEP 12.1.4 IPS LiveUpdateError

    Posted Sep 24, 2017 09:17 PM

    Understood.



  • 6.  RE: SEP 12.1.4 IPS LiveUpdateError

    Posted Sep 24, 2017 09:22 PM

    I think it was because new version 14.x, sometimes need full definition.

    I have same issues in the pass 2 or 3 weeks or last month, and disable the prevent clients from downloading the full definition packages solve it.

    You may try it if you have enable it.

    Server>Management Server>Full Definitions Download



  • 7.  RE: SEP 12.1.4 IPS LiveUpdateError

    Posted Sep 24, 2017 09:24 PM

    These are UNmanaged clients.



  • 8.  RE: SEP 12.1.4 IPS LiveUpdateError
    Best Answer

    Posted Sep 26, 2017 01:55 PM

    Looks like Symantec corrected the issue.  The 9/25/17 r11 IPS defs don't have the problem.



  • 9.  RE: SEP 12.1.4 IPS LiveUpdateError

    Posted Sep 26, 2017 05:59 PM

    Correction - the new defs didn't correct the problem.  We are still researching.   We noticed the issue with the 9/22/17 r12 defs.   Initially, the defs failed with the session callback error.  When we ran LiveUpdate a second time, the 9/22/17 r12 defs installed successfully.  We don't know why. 



  • 10.  RE: SEP 12.1.4 IPS LiveUpdateError
    Best Answer

    Posted Sep 28, 2017 02:53 PM

    Update - still don't know what caused the session callback error.  It occurred on several machines the same day. However, it appears that something corrupted the install - the AV component wasn't functioning correctly.   We reinstalled and that resolved the problem.