Endpoint Protection

My SEPM was configured to receive virus definition from my internal LiveUpdate servers. On the date Symantec resolved SEPM definition updates issue, In order to resolve the Y2K10 SEPM issue quickly, I pointed my SEPM to Symantec and ran LiveUpdate three times to patch the SEPM. SEPM definition showed correct definition date after patch was applied. On the second day, I switched my SEPM back to my internal LiveUpdate server, however, the SEPM always indicated that it had latest definition and the definition did not get updated. I switched to Symantec again; it detected the new definition and downloaded it immediately. I switched back to internal LiveUpdate server; I experienced the issue again. I checked my LiveUpdate server, it had latest definition downloaded from Symantec and distributed, the configuration for download and distribution was select All products of SEP 11.0.

Anyone else see the same issue? Thanks

 To test it configure one group to take definition only from LUA.
In LUA manually run distribution or wait for a day to check if the clients in that group are getting updated.

I have no issues on the client side, the issue is on SEPM, clients get defitnion from my internal liveupdate server each day without any issue, however, SEPM does not get definition updated unless I connect to Symantec. I do not want my SEPM connect to Symantec directly. 

 Try to open clu-prod URL on IE and make sure you are able to access it from SEPM server.
On the LUA reduce the distribution schedule time interval.

That was one of few things I tried, I can see the content in IE.

Configure SEPM to go to LUA and then run luall.exe
see what error you are getting or is it downloading the defs from LUA ..

Thanks Vikram. Should'nt Download Liveupdate Contents launch LUALL as well? any different log will be generated if I run it from command line using luall.exe?

if you manually launch liveupdate you can real time watch what error is without lookingi into logs..

When you launch it from inside SEPM it will just show liveupdated finished with return code 0 or 1 or 4 etc.. 

Ran luall.exe manually and all went fine, looked like it start process 1 to 71 components, no errors, LU completed successfully, however the defintion is showing no change.

Got the same problem here at work.
Home page of SEPM shows 2 computers running the 2010-01-24 R024 definition, while all others are at 2010-01-19 r008.
The 2010-01-19 r008 is the one I manually installed on all desktops and servers in the hope after that they would update via the internal server again, but it doesn't...

The local SEP client on the server does seem to update, and seems to be one of the two running the current definition file, but I have no idea what the other one is.

On my own desktop I manually ran LUALL.exe and I only see the following:

The following Symantec products and components are installed on your computer.
> LiveUpdate
> Symantec Security Software
> Symantec Security Software Update

Initializing...
Connecting to STLUpdate...
Opening update list
The digital signature found on the catalog file has been signed by Symantec Corporation.
Processing update list
Opening update list
Processing update list
All of the Symantec products installed on your computer are currently up-to-date. Remember to check for new updates frequently.

LiveUpdate session is complete.

I run SEPM 11.0.4000.2295 on the server.

When I check the Show LiveUpdate Downloads, it shows that the 2010-01-24 r021 is for 64Bit only. The 32Bit is still at 2009-12-31 r118.
This maybe why the desktops don't update, since they are 32Bit clients.
Checking on of the rare WIndows 7 64Bit desktops we have here, I see it has the 2010-01-24 r021 definitions.

So, maybe the topic starter can check this as well and perhaps he/she has the same problem as me.
Why is 64Bit updated and 32Bit not?

> I run SEPM 11.0.4000.2295 on the server

You should update to RU5 which fixes quite a few things in the base release of SEP.

I don't mind updating to 11.0.5, but reading the main article on the update problems from 2009-12-31, RU4 is covered there.
But, it's a good idea to try out.

Which is the version of LUA you are using? 

If I check in Add/Remove Programs, it says LiveUpdate 3.3.0.69.
Though I am not really sure if that's the LU for SEPM or the SEP client, or if it's used for both.

 LiveUpdate will be common for both SEPM and SEP ,by the time of installation these products will get registered with liveupdate,and the liveupdate will download the updates for all registered products....

So, apart from updating from 11.0.4 to 11.0.5, is there anything I can try to get 32Bit definition files downloaded again?

SENS are you using LUA ?
If yes What is the version ???

We don't use LUA. And to be honest I wouldn't know where to get it from either.

OK if that's the case then upgrade to RU5

I upgraded to RU5 and ran the LiceUpdate from within the SEPM, but the 32Bit files still aren't downloaded.
So, I installed LUA too. Waiting for the 2.9Gb download now..

Well, LUA kinda hangs on a cancel for a job now for almost 3 hours. Even including a server reboot...
I also don't find it very easy to use. Too much settings for not too much it seems to me.

I ended with with re-configing my LUA and that resolved the issue. Symantec has one KB article regarding this issue,

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010010901022848

 
but it did not work for me. I had to delete my download and distribution and reconfig it and that resolved issue.

Think my problem is due to the Enhances Security stuff from IE on our servers.
Probably need to add the locations to the trusted websites. Attempting now.

I removed LUA from the server. What a piece of junk.

So, I'm back to just SEPM11RU5 and not being able to download the 32bit definition files.
Is there a way to clean everything up and start the downloads from scratch, as if I'd just installed the SEPM11?

When I check C:\Program Files\Common Files\Symantec Shared\SymcData I see three directories.
sesmmipsdef32, sesmipsdef64 and sesmvirdef64.
There has been a sesmvirdef32 before, but I deleted it as part of a article to restart the downloading.
Since that the 32bit virus def files don't download.

Try this

How to clear corrupt Virus Definitions from SEPM

 

Thanks for that link AravindKM, it really helped to start over with downloading.
But somehow it downloaded 20091231.118 in it's C:\Program Files\Common Files\Symantec Shared\SymcData\sesmvirdef32.
The 64 bit version is the current one as it downloaded before, 20100125.025 as of today.

I watched the directory's being build again, so I know it downloaded fresh.

I even added *.symantec.com to a list on our ISA server so have traffic to/from this domain to pass through the proxy, instead of using the cache form the proxy server. But still the same date.

Is there anything else I can try? This was the last thing I can come up with.

Even i follow this article
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010010901022848

i hve reconfigured LUA but still SEPM is not updating Although LUA logs show that it has distribute the defininations successfully.

Pls create another thread for your problem......