Hi,

Since the virus definition is not up to date.

I have tried to update content by SEPM and status was succeed. But still not updated to latest definition.

Please advice.

Microsoft Windows Server 2008 Enterprise (x64) SP2

SEP 12.1.2015.2015

Thanks

Run the symhelp tool to find the issue.

Download the Symantec Help (SymHelp) diagnostic tool to detect Symantec product issues

edit

Also try to clean the defintion, may be the lats available defintion is corrupt

How to clear out definitions for a Symantec Endpoint Protection 12.1 client manually

Troubleshooting Client Communication with SEPM

Troubleshooting Out-of-date Definitions on Clients (Part 1)

http://www.symantec.com/tv/allvideos/details.jsp?vid=2236084589001

Troubleshooting Out-of-date Definitions on Clients (Part 2)

http://www.symantec.com/tv/allvideos/details.jsp?vid=2236084558001

Hi,

I have exported log by SymHelp.

Please help to investigate.

Actually 5A and 6A are cluster servers. Both of them have same problem.

Thanks

Attachment(s)

[HKSAPS5A]__2014-10-10__15-32-37.zip   4.83 MB 1 version

[HKSAPS6A]__2014-10-10__15-32-42.zip   5.64 MB 1 version

You should also enable sylink debugging on an affected client, let it run thru a few heartbeats and provide this log as well:

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

Hi Brian,

Then I should enable debug and run symhelp agin ??

Thanks

Yes, to be able to see what's going on.

You can run the symhelp then scan for common issue to find the reason of the problem.
It will show you the reason and solution for the issue..

Sould I select Standard data for Support + Enable product debug logging ??

Otherwise, how to reproduce the issue ?

Thanks

Enable per here:

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

The reports in HKSAPS5A indicate virus definition corruption and a possible communications issue due to the Windows Firewall not containing an expected (installed by SEP) exclusion for the SMC service, SEP's primary communications service.  The disk usage report also indicates that the virus definition directory contains an unusually large amount of data further pointing to the virus definition corruption issue.  In this case the definitions seemed to be delivered intact but the SEP client failed to switch over to the newer set.  

Both the virus definition and disk usage reports link to articles describing how to clear out corrupt definitions or otherwise troubleshoot this type of issue.

If these ready-made solutions do not prove to be successful, then contact support and provide the sylink debug log as instructed above.