Hello all , my SEPM has stopped downloading defination from the internet it is stuck on 8th june. I have already done the following

• Deleted the corrupted definations as per article
• Uninstalled and reinstalled Live Update 
• ran lucatalog -cleanup and -forceupdate
• IESC is disabled

Log.liveupdate file is attached . Please tell me whats the issue , waiting for your kind replies 

Attachment(s)

LOG.docx   79 KB 1 version

It is giving me 2 errors when I run luall.exe

1. LU fails to understand the definations that it is trying to download
2. LU failes to respond in reasonable amount of time 

Version of SEPM is 12.1 RU1 

any 1 ?

What database are you using ?

EVENT - SESSION END FAILED EVENT - The LiveUpdate session ran in Interactive Mode. LiveUpdate found 20 updates available, of which 0 were installed and 20 failed to install.  The LiveUpdate session exited with a return code of 1835, The LiveUpdate server failed to respond in a reasonable amount of time

The LiveUpdate session exited with a return code of 1835: Error - The LiveUpdate server failed to respond in a reasonable amount of time.

Error: "LU1835: Connection to the LiveUpdate server failed" (Enterprise)

Try to change the time out value to 90 on following entries ont the file 'Settings.LiveUpdate' in  the following location.

PREFERENCES\INTERNET_CONNECT_TIMEOUT=45
PREFERENCES\INTERNET_READ_DATA_TIMEOUT=45

Guys after fixing the above . Now it is giving me the following error when I see the new log.liveupdate

.  The LiveUpdate session exited with a return code of 1806, LiveUpdate downloaded all of the updates you requested, but was unable to install any of them.

@Rafeeq and @James . Please tell me how to fix this 

.  The LiveUpdate session exited with a return code of 1806, LiveUpdate downloaded all of the updates you requested, but was unable to install any of them.

What I initally did was that I reinstalled LiveUpdate from Add remove programs , reinstalled my machine , then installed LiveUpdate again , register SEPM with it and ran luall.exe

Any changes have you done in SEPM ?

Error 1825 and 1806 in LiveUpdate logs on Symantec Endpoint Protection client.

have you try manually update SEPM

How to update definitions for Symantec Endpoint Protection Manager (SEPM) using a .jdb file

Is it on embedded DB or SQL? does it replicate with other server? when you uninstall/reinstalled liveupdate did you remove the previous liveupdate folder..?

its on embedded , no replication . When I installed reinstalled liveupdate from add remove programs i did not remove the live update folder from C:\ProgramData\Symantec\LiveUpdate

Am i supposed to delete this whole folder rafeeq of Liveupdate ? and then reinstall LU ?

I meant delete C:\ProgramData\Symantec\LiveUpdate when I reinstall LU from Add remove programs and then reinstall LU ? then re-register it ?

Please follow below process

How to Uninstall and Reinstall LiveUpdate on SEPM 12.1 (Enterprise Edition or Small Business Edition)

yes  delete those, after u remove Livupdate ,do a search for liveupdate folder and then delete it, this folder sometimes will contain the settings.liveupdate file even after removing liveupdate

You might want to try reverting to the version of the LiveUpdate client that came with your SEPM.

12.1RU1 came with v3.3.1.23 of LiveUpdate, whereas 12.1RU1MP1 used the version you've installed (3.3.2.2).

Also, don't forget to clear out the LU cache as indicated by the below article:

http://www.symantec.com/docs/TECH106450

SML I am installing the LU that is within the SEPM folder from which I installed SEPM 

Guys the problem is still persistent after doing the above mentioned steps 

As long as you're sure you have the right version (3.3.2.2 for 12.1.1101.401, and 3.3.1.23 for 12.1.1000.157), then I'd recommend follwoing the article I linked.

I'd suggest you post the updated logs too

SML the logs says that it found all the updated but failed to download any of them. Please advise what to do next ?

Here is the updated log SML 

Attachment(s)

LOG_0.docx   83 KB 1 version

It appears to be downloading he defs now, but is unable to process them as below:

6/26/2014, 9:25:59 GMT -> Progress Update: PATCH_START: Patch File: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt598\1403758927jtun_sep12enncur26.m26", Script File: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt598\SP12v32f.dis"
6/26/2014, 9:25:59 GMT -> Progress Update: SECURITY_PACKAGE_TRUSTED: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt598\1403758927jtun_sep12enncur26.m26"
6/26/2014, 9:25:59 GMT -> Signer: cn=Symantec Corporation,ou=Locality - Culver City,ou=Product Group - LiveUpdate,ou=SymSignature 2005,o=Symantec Corporation
6/26/2014, 9:25:59 GMT -> Progress Update: UNZIP_FILE_START: Zip File: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt598\1403758927jtun_sep12enncur26.m26", Dest Folder: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt598"
6/26/2014, 9:26:00 GMT -> Progress Update: UNZIP_FILE_FINISH: Zip File: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt598\1403758927jtun_sep12enncur26.m26", Dest Folder: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt598", HR: 0x0       
6/26/2014, 9:26:00 GMT -> Added package to cache...
6/26/2014, 9:26:00 GMT -> LiveUpdate couldn't expand replacement path [spcVirDef32InstallDir].
6/26/2014, 9:26:00 GMT -> Progress Update: PATCH_ERROR: Patch File: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt598\1403758927jtun_sep12enncur26.m26", Script File: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt598\SP12v32f.dis", HR: 0x802A0006
6/26/2014, 9:26:00 GMT -> HR 0x802A0006 DECODE: E_DIS_SCRIPT_SYNTAX_ERROR
6/26/2014, 9:26:00 GMT -> Progress Update: PATCH_FINISH: Patch File: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt598\1403758927jtun_sep12enncur26.m26", Script File: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt598\SP12v32f.dis", HR: 0x802A0006
6/26/2014, 9:26:00 GMT -> HR 0x802A0006 DECODE: E_DIS_SCRIPT_SYNTAX_ERROR
6/26/2014, 9:26:00 GMT -> EVENT - PRODUCT UPDATE FAILED EVENT - Update available for SEPM Virus Definitions Win32 v12.1 - MicroDefsB.CurDefs - SymAllLanguages. Update for CurDefs takes product from update 0 to 140625032. Server name - liveupdate.symantecliveupdate.com, Update file - 1403758927jtun_sep12enncur26.m26, Signer - cn=Symantec Corporation,ou=Locality - Culver City,ou=Product Group - LiveUpdate,ou=SymSignature 2005,o=Symantec Corporation, package install code 0. The Update executed with a result code of 1825, => The install script for this product had a syntax error, so LiveUpdate could not install it.

Out of curiosity, can you post the sesmlu.log as well?

Oh yeah, note how the LU1825 error relates to James's earlier post too

I have done exactly the same steps mentioned by James SML 

I cannot do the Run a repair on the SEP client through Add/Remove Programs to rebuild the two LiveUpdate files causing the issue, mentioned in the james client as SEPM doesnt have SEP client installed on same machine ? 

Am I suppose to repair the SEPM itself ?

Typically reregistering LU will recreate those files (product inventory and settings).  Check and see what they say (i.e. make sure the time stamp has been updated).  Also, any luck on that sesmlu.log file I mentioned earlier?

Well Guys I fixed it temporarily by dropping the jdb to update the AV definations.

Altough I applied all of the above mentioned steps shared by all of you, but the issue was not resolved so as a workaround I temporarily used the JDB file. 

But again need a permement solution for this.

I think you've got the links to the articles that refer to the error codes you're seeing.  It might be time to log a case with Symantec Support!

Otherwise, any luck with posting the sesmlu.log file I mentioned (twice) earlier?

Also, can you make sure all other aspects are fine (e.g. disk space, folder permissions, etc.)  Finally, do you get the same error when kicking off the LU attempt from within the SEPM?

Well I saw the error code 4 error when I did it within the SEPM console. Regarding the sesmlu.log I will share it with you once I visit my client again.

Secondly about the other aspects there is adequate space on the SEPM and folder permissions.

thanks for your help

But I did oberve that it usuall fails with these errors when it is processing the update 4 out of 20. Thanks

Symantec asked to upgrade to the latest version 

To be fair to them, there have been a lot of fixes since November 2011 when RU1 was released.  An upgrade is definitely worthwhile.

The norm is to always get on the latest version before troubleshooting issues. Just to rule out the obvious.

Hello Guys , I am attaching the SesmLu.log . Please have a look at it and comment 

Attachment(s)

SESMLu.docx   933 KB 1 version

Guys any findings on the abobe mentioned LOG ? thanks 

Whats the number of content revision set to under..

SEPM Console, go to Admin>Servers>Local Site>Edit Site Properties

they are set to 3 rafeeq

There's very many "ERROR" category logs in here, and the majority seem to refer to "Access Denied" messages when attempting to make changes to registry.  Has this server undergone any hardening?

No not really SML as this is only used/dedicated to the SEPM.

So whats the next plan of action to fix this problem guys ?

Can you run the SymHelp and see if complains about something

From the log it says

http://127.0.0.1:9090/servlet/ConsoleServlet?ActionType=ConfigServer&action=PublishLuInventory

06/26 13:28:18 [12c0:1008] ERROR       SesmLu InternetOpenUrl failedat .\SesmLu.cpp[1567]

06/26 13:28:18 [12c0:1008] ERROR       SesmLu Server failed to publish the LU inventory.at .\SesmLu.cpp[1319]

can you try this in a browser and check whats the response code you get

1. Open up a web browser on the server computer and navigate to the following URL:
   http://localhost:9090/servlet/ConsoleServlet?ActionType=ConfigServer&action=PublishLuInventory
    
2. Verify that the "LuSesmContentCatalog.xml" file exists in this location:
   C:\program files\symantec\symantec endpoint protection manager\data\outbox\content
    
3. After approximately 5 minutes, a notification will appear stating that the modification has been completed.
4. Force a LiveUpdate on the Symantec Endpoint Protection Manager.

Thanks rafeeq for the response, sure I will do it and will update you on it accordingly.   

Hello Guys still the same problem

Guys I am going to upgrade it to 12.1.4 MP1 and once it is updated I will purge the existing protection definations re-install the LU , re-register with SEPM and run luall.exe and see whats the result now.

What do you guys suggest ?

I suggest first you can raised support ticket and take symantec support for more troubleshooting

Well as per the Symantec , they asked to upgrade to the latest version. 

Rafeeq I have tried your suggested steps still no good. what do next ?

Guys any other troubleshooting step that I am required to do ?

Have you investigated the registry-related permissions errors I pointed out earlier?

Thanks guys for your replies and support. This issue has been resolved.

Given the length of this thread and the changes attempted, I think it'd be beneficial if you could share the root cause and eventual fix if possible?

I think whatever you can share would be useful to the community at large

Here are the steps which I did.

1. Purged all the definations
2. Re-installed the LU component
3. Upgraded SEPM to the latest version
4. Then ran a repair on the SEPM
5. make modifications and changes in the SEPM configuration files 
6. deleted few registery files
7. Then ran luall.exe from cmd with admin previliges 

I performed all these steps in a single go and it fixed this problem 

SMLatCST I was away so could not reply, sure I would love to share the cause with the community.