Endpoint Protection

I have the updates being pulled at 2AM EST. I have GUP's for all of my sites, however the SEPM is generating considerably large amounts of traffic at different times of the day. I need to get this under control. I will add more, but copy and paste STILL does not work under IE 11 in the SEP forums.

Row Labels    Sum of Bytes    Host/Usr20301258    
IP        20301258    EP Server

This happened at 8AM EST, well after the 2:00AM designated time for LU downloads

This is for the clients so they're going out to LU for updates.

Did you confirm clients are pulling from the GUPs?

Go to Monitors >> Logs >> System log and set to Client Activity

https://www-secure.symantec.com/connect/articles/sepm-121-advanced-settings-filter-options-client-activity-logs

This liveupdate setting will pull the defs from internet not from SEPM.

since you have set to download only if they are 2 days old, Its getting 2 days definiton.

Each client is listed by the local site that they are in which has a local GUP. How can I confirm/find which clients may NOT be pulling the updates from the GUP?

See the link I posted above for advanced filtering options using the "GUP" keyword but this policy has the clients getting updates from Symantec LU

I am confused, this is the default setting, should this be changed? Would changing it help optimize bandwidth?

I want the clients to get the updates from their local GUP. Sorry man, I am very confused here.

To configure SEPM to get its updates from LU go to Admin >> Select your site and "Edit Site Properties"

Select the LiveUpdate tab and set the schedule here

See if this helps:

Configuring Group Update Providers

You just need to apply a LU policy with the GUP configured to the clients you want connecting to the GUP

There are 2 liveupdate settings

whatever you change under policy tab is for clients

ideally your clients should be getting updates from SEPM and not from internet

Open SEPM

Policies

Liveupdate policy

check the option use the default management server

unchek use symantec liveupdate server, once you uncheck this the Lu schedule will be grayed out

Admin - server tab -Liveupdate scheduel is for SEPM.

:)

change the clients to get from SEPM, they wont go outside and will get only delta from SEPM, issue fixed :)

The 2nd option is not checked in many of them, I am guessing this is the root of all of this...

Well clients won't use Symantec LU, they will use the SEPM or GUP to get content.

Which policy is this? Does this one have a GUP configured?

Yes, this is for a GUP site. I don't know what I am supposed to do.

Ok so just below what's in your screenshot, you should see the Group Update Provider section

Do you have a check next to "Use a Group Update Provider"? Than you can select the button for Group Update Provider and configure within here

All of the GUP's are in place and have been since I put this together. Each site has a Local GUP

1st option , use SEpM

2nd Use Symantec liveudpate server or Internal Liveupdate administrator

the first screen shot what you posted had second option checked. which will tel clients to use internet , not sepm, not gup

Do you have a separate LU policy for each GUP? Is it applied to each group where the clients reside?

I have to check.

All sites are configured to use a GUP, where am I going wrong here? I cannot see it. :_(

So each site has it's own LU policy?

Here is the simple method

Open SEPM

Policies - Liveupdate policy

Here You will see number of Liveupdate policies

check the Location use count  number  for each policy, this shows on how many group this policy is in place.

Open each Lu policy and check if they have any GUP configured

Yes, every site has a GUP onsite...I have designated a server in each location to be the GUP, the GUP os designated in the top level of the site.

This his been set up this way for a couple of years, why would this cause a bandwidth spike now?

I have a case open with Symantec, if this was a frequent occuerence I would follow your advice, but this is an isolated incident and I want to be sure it does not happen again.

and BOTH options are checked

check the option use the default management server

use symantec liveupdate server

Hi

What is the heartbeat Interval set for the client communication ?

Regards

OK, I think I am seeing some light at the end of the tunnel, some of the locations did in fact have the 2nd option checked, a majority of these sites didn't.

"unchek use symantec liveupdate server, once you uncheck this the Lu schedule will be grayed out"

30 Mins

Here ya go

Did you find out which  of your liveupdate policy had GUP setup?

You need to apply that policy to your groups

All sites have a GUP setup.

This is what I had to do. Please see attachment.