Linux client installation SEP 14.3 RU1 - Malfunctioning

[Kiril Koltchakov]

I have re-installed AV SEP, but it did not do the work.
The kernel-modules for Endpoint Protection were also manually compiled, but still the status is Malfunctioning:

ServerName:~ # /opt/Symantec/symantec_antivirus/sav info -a
Malfunctioning

Below is the output of the commands:

ServerName:~ # /opt/Symantec/symantec_antivirus/sav autoprotect -e

Warning: On managed client, the settings modified manually will be overwritten by policy from management server.

ServerName:~ # /opt/Symantec/symantec_antivirus/sav info -e

Unable to get current engine version.

ServerName:~ # /opt/Symantec/symantec_antivirus/sav info -p

14.3 (14.3 MP1) build 1169 (14.3.1169.0100)

ServerName:~ # /opt/Symantec/symantec_antivirus/sav info -a

Malfunctioning

Required files are present:

-r--r--r-- 1 root root 552 Aug 26 17:25 /etc/sysconfig/symcfgd

-rw-r--r-- 1 root root   6 Jan 21 12:10 /var/run/symantec/symcfgd.pid

Kernel version:

4.12.14-122.26-default

Any advices are wellcome. 

Thank you. 

[Moukhtar GALIMZHAN]

Hi Kiril,
You described 14.3 (14.3 MP1) build 1169 (14.3.1169.0100) manipulations, but discussion is concern on SEP 14.3 RU1 - thtere are drammatic difference of those versions.
SEP 14.3 RU1 has no sav command as well as  /opt/Symantec/symantec_antivirus folder is not presented with SEP 14.3 RU1.
I would say SEP 14.3 RU1 does not provide proper tools lake sav, sadiag & etc., as it was till SEP 14.3 MP1.(зла не хватает)

[Kiril Koltchakov]

Hello Moukhtar, 

We tried to install both version and the result is the same. Ones client generated from SEPM console and another one downloaded directly from Broadcom website. 
I both situation an agent is linked to the SEPM console, but it repoting as malfunctioning and can't download AV definitions. 

Thank you.

[jondkauf]

Hello Krill,

it seems like the SEP client has not run liveupdate and downloaded/applied the virus definitions.    Is your SEP for Linux client configured to go out to our public liveupdate servers or from an internal Liveupdate server?

Thanks,

------------------------------
Jon Kaufman
Strategic Support Engineer
Broadcom
------------------------------

[Kiril Koltchakov]

Hi Jon,

we installed AV SEP on server which is linked to SEPM console internally.
So AV definitions should be taken from SEPM not internet.
Maybe we should change something in settings of AV SEP on server then, to have this Agent uploaded with AV definitions from SEPM?
what kind of Network traffic is required between AV SEP Agent and SEPM to have access to AV definitions downloading.

Thank you.

[Martin Kelemen]

The Endpoint Protection Manager cannot host Linux LiveUpdate content the same way as it does for Windows clients.

You can update the SEP client that is installed on Linux in the following ways:

• Directly from Symantec's LiveUpdate server.
• Using LiveUpdate Administrator (LUA). See Using the LiveUpdate Administrator 2.x to download updates for Symantec Endpoint Protection for Linux for information on how to configure LUA for this content.
• The Endpoint Protection Manager cannot host Linux LiveUpdate content the same way as it does for Windows clients. See Symantec Endpoint Protection Manager can be configured as a reverse proxy for downloading and caching the latest Linux LiveUpdate content on a SEPM server.
• Using the Intelligent Updater. See How to update a Linux-based computer with Intelligent Updater definitions for more information.