Endpoint Protection

LiveUpdate on my SEPM has stopped running automatically per the schedule. I was able to kick if off manually and it would update but now that has stopped as well. Is there a log somewhere I can check to see what's going on? I'm not seeing any errors in SEPM.

SEPM is on 11.0.6 running on Server 08 x64

HI you may try this to get an exact error.

1] go control panel
2] symnatec liveupdate and make it in the interactive mode.
3] Go run and type luall
4] this let you know exact error.

I did get a message that said another instance ws running. I checked task manager and LUCOMS~1.exe is running. Seems to have been for some time. Could it be corrupt?

End the LUCOMS~1.exe and try to run again, if it fails it will give us an error that will help us to move forward.

Are you getting any errors in Log.LiveUpdate which is present in C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate?As prachand told kill LUCOMS~1.exe and go to start---->run type luall and click ok.What is the error you are getting here?

I'm not getting errors that I can see, unless I should be looking for a specific error code.

The weird thing is, LU ran automatically yesterday without issue. Then today it did not run and I kicked it off manually and it updated.

The only thing that was recently done was the addition of 2 GUPs. I'm not sure how this could affect anything but that has been the only change made.

Try posting Log.liveupdate from %appdata%\Symantec\Liveupdate\log.liveupdate

Here is the link:

http://www.2shared.com/file/ipr-HAsO/Log.html

I doubt this is the issue, but make sure you didn't designate the SEPM machine as a GUP.

No, I did not :-)

I just found it weird that it seemed to stop after I added the two GUPs but we've had GUPs in place before so I didn't think it was the problem but worth mentioning nonetheless.

I'm wondering if something changed within our infrastructure and I can check w our guys here but I can still run it manually so I would think something else is up.

I do see one thing in the LU log in SEPM that says "Not in GZIP format" but I'm not sure what that means. This was after I ran LU manually again and my defs did NOT update this time so maybe there is an issue here?

not in zip format in when u delete packages assigned to your groups; sometimes :)
check your network; try this document to see if fireweall is blocking ; re-registering LU with SEPM should do the trick
http://service1.symantec.com/SUPPORT/sharedtech.nsf/d3c44a1678bd8f45852566aa005902cb/c0aeb869920b38b688256d980074e389?OpenDocument&prod=Symantec%20AntiVirus%20Corporate%20Edition&ver=10.0&src=ent&pcode=sav_ce&dtype=corp&svy=&prev=&miniver=sav_ce_10


http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009081803143348

The only thing that concerns me is I'm not getting a LU error per the re-register KB article. Would it hurt to remove, re-install and re-register though?

Make sure that the SEP client on the SEPM does not have its own schedule for LiveUpdate.  Are there any other Symantec products that might also have a LiveUpdate schedule, like Mail Security for Microsoft Exchange?

Title: 'Configuring LiveUpdate for Symantec Mail Security for Microsoft Exchange (SMSMSE) when it is installed on the same server as Symantec Endpoint Protection (SEP)'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009022514040748

sandra

Backup Exec is also on the SEPM, has been for a long time.

The SEP client on the server is scheduled to check Symantec LU server every Sunday but this has been this way sine it was installed. It always get it's updates from SEPM first though.

MaY be the account for schedule task has expired password.

Found this error:

The process ConfigServerHandler.processLUcontent can not lock the process status table. The process status has been locked by the server C[random characters] (ConfigServerHandler.processLUContent) since 2010-06-04 23:51:17

...and what else changed at about the same time?  Do you use non-console RDP session when remotely administering?

I just can't find much on this error, and the one reference I do find indicates 'upgrading to RU5' fixed it.  Another similar error suggests non-console RDP access was to blame.

sandra

Nothing has changed that I've found.

I do have a case open and working with an engineer on it. The one thing I did find is that one of my SEPMs ran out of space. When I shut it off, everything seemed to come back up. LiveUpdate ran but both x32 andx64 virus defs still failed but I can manually update using the JDB file.

I'm currently gathering logs for review