Live Update still keeps failing

[Adrian - Labkom]

Hello everyone!

Since January 4th this year we get a lot of Error Messages from SEPM(On-Prem, RU9) about Live Update failing. 

We saw that the Problem supposed to be solved already (there was an official announcment from Broadcom), but it still keeps going on.

Is this still an official Problem? Or is it a Problem with our Server?

The Error Message which we get is:

Event type:	LiveUpdate All process failed to launch
Event description:	LiveUpdate encountered one or more errors. Return code = 4.

When we then start the Live Update manually it goes thru.

Please advise and thank you in advance!

Kind Regards,

Adrian 

[cookie999]

We have also continued to see it failing randomly on our 3 SEPM (On-Prem, RU7) servers.

In the LiveUpdate log (lux.log), random updates were failing (if I recall related to RU3).  We haven't had any since Thursday 16th January, so hoping it has now been fixed.

[Adrian - Labkom]

In our case it is happening every day. Yesterday for example 6 times during the day. 

[cookie999]

If you check in your lux.log you might be able to see what it is failing on - when I realised it was just failing on one def but was succeeding in others, I stop looking into as much as the def wasn't applicable (but I still kept and eye on the log each time it failed):

Symantec\Symantec Endpoint Protection Manager\tomcat\logs\lux.log

[Adrian - Labkom]

This is what I found in the LOG:

07:35:50.058432     [Server - START]
07:35:50.058432         Host ID: {05B95CA6-150B-4273-8B34-2951B6582140}
07:35:50.058432         Status Code: 1
07:35:50.058432         Status Message: Server was not selected
07:35:50.058432         Transport Return Code: 0x80010731
07:35:50.058432         Transport Return Message: FAIL - download failed
07:35:50.058432         Protocol: HTTPS
07:35:50.058432         Hostname: liveupdate.symantecliveupdate.com
07:35:50.058432         Port: 443
07:35:50.058432         Path: 
07:35:50.058432         Proxy ID: {00000000-0000-0000-0000-000000000000}
07:35:50.058432         Proxy Bypass: false
07:35:50.058432     [Server - END]
07:35:50.058432     Used proxy list was empty
07:35:50.058432 [Server Selection - END]
07:35:50.058432 [Finalize Session - START]
07:35:50.058432     Result Code: 0x00010000
07:35:50.058432     Result Message: OK
07:35:50.058432     Component Status Changes:
07:35:50.058432         None
07:35:50.058432 [Finalize Session - END]
07:35:52.183214 [Session Results - START]
07:35:52.183214     Session Result Code: 0x80010830
07:35:52.183214     Session Result Message: FAIL - failed to select server
07:35:52.183214     [Component Result - START]
07:35:52.183214         Component ID: {F334A5FB-0AFC-BEDC-2CFF-5EDF6B314D43}
07:35:52.183214         Display Name: SEPM Web Extensions Win64 14.3 RU8
07:35:52.183214         PVL: SEPM Web Extensions Win64 14.3 RU8_MicroDefsB.CurDefs_SymAllLanguages
07:35:52.183214         Result Code: 0x00010000
07:35:52.183214         Result Message: OK

Does this mean that there ist a problem with the  "SEPM Web Extensions Win64 14.3 RU8" ?

The thing is, we didnt change anything in the configuration in the last few months. This is why I dont understand why are the errors comming now and so often.

[kraat2025]

Symantec update sites resolve to the same IP address as Cloudflare.
After we added also this "VMWare Web -service" to firewall, Liveupdate works fine.

ComputerName : liveupdate.symantecliveupdate.com
RemoteAddress : 162.159.140.167
RemotePort : 443

Network
162.159.128.0/18
162.159.128.1 - 162.159.191.254
Autonomous System Label
CLOUDFLARENET

[Sym_DB]

When this issue started for us we resolved it by editing the Local Site properties and under source Server we set it from default to using a specified server, this was with the address https://liveupdate.symantec.com

The failures stopped so we have left it like this ever since.