Endpoint Protection

 View Only

  • 1.  SEP Manager not pushing updates

    Posted Mar 08, 2010 05:17 PM
     For some reason my SEP Manager doesnt seem to be pushing updates out to clients.  Ive tried pulling them from the clients and tried going into clients in the SEP Manager and right clicking and instructing clients to update.  Nothing seems to work.  I've attached a screenshot, the definitions seem to be getting to the server but no further.  Any thoughts?

    [SEPM.JPG


  • 2.  RE: SEP Manager not pushing updates

    Posted Mar 08, 2010 05:27 PM
    Do the clients have a firewall?  Also, are you sure the server is downloading the updates?

    Another issue is sometimes the updates need to be cleared of the clients.  Normally located in Program Files\Common Files\Symantec Shared\VirusDefs.  Sometimes when my updates dont apply I clear out that folder.  Normally this is during hte initial install.

    Also we have a lot of PCs that have been off for a while and they of course will not get updates until the next time they connect to the network.


  • 3.  RE: SEP Manager not pushing updates

    Posted Mar 08, 2010 08:28 PM
     The clients only firewall is the endpoint protection one.  I installed the whole setup back in the first week of January and after the initial problem with 2009 defs the defs downloaded and pushed just fine up until the 27th.  I didnt make any changes.

    I just tried clearing out that folder on clients but it didnt help.  Most of these computers are desktops that are left on 24/7 so they should be updating.  

    I guess its possible its not actually downloading the the SEP manager.  Does anyone know where it actually downloads to in the manager or how I could check that?

    Thanks


  • 4.  RE: SEP Manager not pushing updates



  • 5.  RE: SEP Manager not pushing updates

    Broadcom Employee
    Posted Mar 09, 2010 12:44 AM
    run the sylink logs on client and post it here.


  • 6.  RE: SEP Manager not pushing updates

    Posted Mar 09, 2010 10:19 AM
     I tried doing everything posted in that link, but it still does not seem to be working.  Here are the logs of a client with a new installation and an older installation.  

    NEW INSTALL

    2 03/08/2010 9:00:53 PM Information 1207020E Location has been changed to Default.
    3 03/08/2010 9:00:53 PM Information 1207020E Location has been changed to Default.
    4 03/08/2010 9:00:57 PM Information 12070201
     
    Windows Version info:
     
    Operating System: Windows XP (5.1.2600 Service Pack 3)
     
    Network  info:
     
    No.0  "Local Area Connection"  00-24-7e-6d-cd-d4  "Intel(R) 82567LF Gigabit Network Connection" 10.61.195.48 
     
    5 03/08/2010 9:00:57 PM Information 12070202 Symantec Management Client has been started.
    6 03/08/2010 9:01:06 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    7 03/08/2010 9:02:38 PM Information 12070306 Received a new policy with serial number 5832-03/08/2010 15:37:03 935 from Symantec Endpoint Protection Manager.
    8 03/08/2010 9:02:38 PM Information 12070307 Applied new policy with serial number 5832-03/08/2010 15:37:03 935 successfully.
    9 03/08/2010 9:02:38 PM Information 12070306 Network Threat Protection applied a new IPS library .
    10 03/08/2010 9:03:18 PM Information 1207030A The Network Threat Protection already has the newest policy.
    11 03/08/2010 9:05:02 PM Information 1207021A Stopping Symantec Management Client....
    12 03/08/2010 9:05:03 PM Information 12070204 Symantec Management Client is stopped.
    13 03/08/2010 9:10:12 PM Information 1207020E Location has been changed to Default.
    15 03/08/2010 9:10:12 PM Information 1207020E Location has been changed to Default.
    16 03/08/2010 9:10:12 PM Information 12070218 Symantec Management Client has been activated.
    17 03/08/2010 9:10:14 PM Information 12070202 System has been restarted since received restart command.
    18 03/08/2010 9:10:15 PM Information 12070201 Network Threat Protection -- Engine version: 11.0.301
     
    Windows Version info:
     
    Operating System: Windows XP (5.1.2600 Service Pack 3)
     
    Network  info:
     
    No.0  "Local Area Connection"  00-24-7e-6d-cd-d4  "Intel(R) 82567LF Gigabit Network Connection" 10.61.195.48 
     
    19 03/08/2010 9:10:15 PM Information 12070202 Symantec Management Client has been started.
    20 03/08/2010 9:11:39 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    21 03/08/2010 9:12:07 PM Information 1207030A The Network Threat Protection already has the newest policy.
    22 03/09/2010 10:00:13 AM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (BES)
    23 03/09/2010 10:00:24 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    24 03/09/2010 10:06:48 AM Information 1207020E Location has been changed to Default.
    25 03/09/2010 10:06:48 AM Information 12070218 Symantec Management Client has been activated.
    26 03/09/2010 10:06:48 AM Information 1207020E Location has been changed to Default.
    27 03/09/2010 10:06:53 AM Information 12070218 Symantec Management Client has been activated.
    28 03/09/2010 10:07:12 AM Information 12070201 Network Threat Protection -- Engine version: 11.0.301
     
    Windows Version info:
     
    Operating System: Windows XP (5.1.2600 Service Pack 3)
     
    Network  info:
     
    No.0  "Local Area Connection"  00-24-7e-6d-cd-d4  "Intel(R) 82567LF Gigabit Network Connection" 10.61.195.48 
     
    29 03/09/2010 10:07:12 AM Information 12070202 Symantec Management Client has been started.
    30 03/09/2010 10:08:45 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    31 03/09/2010 10:08:51 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    32 03/09/2010 10:11:28 AM Information 1207030A The Network Threat Protection already has the newest policy.


    O    LD INSTALL

    136 2/28/2010 3:58:08 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    137 3/1/2010 4:01:28 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    138 3/1/2010 4:06:57 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    139 3/2/2010 4:04:27 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    140 3/2/2010 9:16:24 PM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (10.61.195.93)
    141 3/2/2010 9:16:24 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    142 3/2/2010 9:22:53 PM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (BES)
    143 3/2/2010 9:25:34 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    144 3/2/2010 9:28:51 PM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (BES)
    145 3/2/2010 9:28:52 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    146 3/2/2010 10:15:26 PM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (10.61.195.93)
    147 3/2/2010 10:20:15 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    148 3/2/2010 10:56:55 PM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (10.61.195.93)
    149 3/2/2010 10:56:56 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    150 3/3/2010 12:38:31 AM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (BES)
    151 3/3/2010 12:38:32 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    152 3/3/2010 12:55:29 AM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (10.61.195.93)
    153 3/3/2010 12:58:10 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    154 3/3/2010 5:51:25 AM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (10.61.195.93)
    155 3/3/2010 5:54:05 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    156 3/3/2010 6:46:31 AM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (BES)
    157 3/3/2010 6:46:32 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    158 3/3/2010 6:50:16 AM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (10.61.195.93)
    159 3/3/2010 6:55:05 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    160 3/3/2010 7:17:30 AM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (10.61.195.93)
    161 3/3/2010 7:17:31 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    162 3/3/2010 7:56:24 AM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (BES)
    163 3/3/2010 7:56:25 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    164 3/3/2010 11:06:54 AM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (10.61.195.93)
    165 3/3/2010 11:09:35 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    166 3/3/2010 11:59:27 AM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (10.61.195.93)
    167 3/3/2010 11:59:28 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    168 3/3/2010 5:33:54 PM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (BES)
    169 3/3/2010 5:33:55 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    170 3/3/2010 5:39:54 PM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (10.61.195.93)
    171 3/3/2010 5:39:55 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    172 3/6/2010 5:48:27 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    173 3/7/2010 5:53:59 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (BES)
    174 3/7/2010 5:59:29 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    175 3/8/2010 3:37:33 PM Information 12070306 Received a new policy with serial number 35A1-03/08/2010 15:37:03 935 from Symantec Endpoint Protection Manager.
    176 3/8/2010 3:37:41 PM Information 12070307 Applied new policy with serial number 35A1-03/08/2010 15:37:03 935 successfully.
    177 3/8/2010 3:45:57 PM Information 1207021A Stopping Symantec Management Client....
    178 3/8/2010 3:46:01 PM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (10.61.195.93)
    179 3/8/2010 3:46:39 PM Information 12070204 Symantec Management Client is stopped.
    180 3/8/2010 3:53:53 PM Information 1207020E Location has been changed to Default.
    181 3/8/2010 3:53:53 PM Information 1207020E Location has been changed to Default.
    182 3/8/2010 3:53:53 PM Information 12070218 Symantec Management Client has been activated.
    183 3/8/2010 4:04:10 PM Information 12070218 Symantec Management Client has been activated.
    184 3/8/2010 4:04:33 PM Information 12070201 Network Threat Protection -- Engine version: 11.0.301
     
    Windows Version info:
     
    Operating System: Windows Server 2003 family (5.2.3790 Service Pack 2)
     
    Network  info:
     
    No.0  "Local Area Connection"  00-19-b9-fe-88-c2  "Broadcom NetXtreme Gigabit Ethernet" 10.61.195.93 
     
    185 3/8/2010 4:04:33 PM Information 12070202 Symantec Management Client has been started.
    186 3/8/2010 4:19:18 PM Information 1207021A Stopping Symantec Management Client....
    187 3/8/2010 4:19:31 PM Information 12070204 Symantec Management Client is stopped.
    188 3/8/2010 4:28:44 PM Information 1207020E Location has been changed to Default.
    189 3/8/2010 4:28:44 PM Information 12070218 Symantec Management Client has been activated.
    190 3/8/2010 4:28:44 PM Information 1207020E Location has been changed to Default.
    191 3/8/2010 4:38:54 PM Information 12070218 Symantec Management Client has been activated.
    192 3/8/2010 4:39:07 PM Information 12070201 Network Threat Protection -- Engine version: 11.0.301
     
    Windows Version info:
     
    Operating System: Windows Server 2003 family (5.2.3790 Service Pack 2)
     
    Network  info:
     
    No.0  "Local Area Connection"  00-19-b9-fe-88-c2  "Broadcom NetXtreme Gigabit Ethernet" 10.61.195.93 
     
    193 3/8/2010 4:39:07 PM Information 12070202 Symantec Management Client has been started.
    194 3/8/2010 4:39:55 PM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    195 3/8/2010 4:47:11 PM Information 1207030A The Network Threat Protection already has the newest policy.
    196 3/8/2010 5:40:57 PM Information 12071046 TruScan has generated an error: code 15: description: Scan not supported (Invalid OS)
    197 3/9/2010 8:07:52 AM Information 12070304 Disconnected from Symantec Endpoint Protection Manager (10.61.195.93)
    198 3/9/2010 8:12:02 AM Information 12070219 Network Threat Protection's firewall and Intrusion Prevention features are disabled
    199 3/9/2010 8:33:42 AM Information 12070218 Symantec Management Client has been activated.
    200 3/9/2010 8:36:32 AM Information 12070301 Connected to Symantec Endpoint Protection Manager (10.61.195.93)
    201 3/9/2010 8:36:37 AM Information 12109999 Symantec Endpoint Protection has determined that the virus definitions are missing on this computer. This computer will remain unprotected from viruses until virus definitions are downloaded to this computer.
    202 3/9/2010 8:36:37 AM Information 12109999 Symantec Endpoint Protection has determined that the virus definitions are missing on this computer. This computer will remain unprotected from viruses until virus definitions are downloaded to this computer.
    203 3/9/2010 8:39:07 AM Information 12109999 Symantec Endpoint Protection has determined that the virus definitions are missing on this computer. This computer will remain unprotected from viruses until virus definitions are downloaded to this computer.


     


  • 7.  RE: SEP Manager not pushing updates

    Posted Mar 10, 2010 01:13 AM
    paste/attach the scm-server-0.log with is present in Program Files \Symantec\Symantec Endpoint Protection Manager\tomcat\logs.

    Whether you had done any configuration changes recently..Like chge the ip/hostname etc..     

    Symantec Endpoint Protection: LiveUpdate Troubleshooting Flowchart