Endpoint Protection

 View Only

Managing LiveUpdate Administrator 2.x Space Usage 

Jan 02, 2012 06:23 AM


Admins who have chosen to implement LiveUpdate Administrator 2.x (LUA 2.x) on their network are often surprised at how much bandwidth and space this internal LiveUpdate server consumes.  There can be a lot of confusion over what is normal and questions if the product is purging old contents correctly or if something is wrong,  This article will describe some common situations and offer advice and answers.

First off: not every network needs LUA 2.x to keep its Symantec products up-to-date.  LUA is a fantastic tool when used correctly on capable hardware, but in many situations there are other solutions which are recommended.  In an environment where Symantec Endpoint Protection is the only Symantec product, and the endpoints and Symantec Endpoint Protection Managers (SEPMs) do have Internet access, it's usually best to allow the SEPMs to download and distribute all the necessary contents by themselves.  Some additional details (and situations when LUA 2.x is actually required) are described in the following article:

When is it Recommended to Use LiveUpdate Administrator 2.x with Symantec Endpoint Protection?
Article URL http://www.symantec.com/docs/TECH154896

Also, definitely read this article:

Best Practices for LiveUpdate Administrator (LUA) 2.x
Article URL http://www.symantec.com/docs/TECH93409


What Gets Stored, Where?  Why?

Why are there "duplicate" copies of the same files seen on the drive where LUA is installed?  This is by design.  There are typically 3 separate places that LUA will use for content. 

  1. TempDownload” which is where updates are saved until they have been successfully retrieved from the Internet and moved to the permanent storage location (“Manage Updates”). This location can be set in the LUA server’s preferences. It does not need to be on the same default C drive.  It is normal for this folder to be empty after the materials have been downloaded successfully and transferred to their “permanent” location.
    (One technical note: despite its name, this folder is used as temporary space during both Download and Distribution tasks- not just downloads. If a download task and separate distribution task are running at the same time, TempDownload will temporarily grow quite large.)
  2. The “Manage Updates” folder ---- this is the location where the LUA program keeps its “permanent” copies of materials. Usually, on a Windows 2003 server, that is "C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate Administrator\Downloads." In releases prior to LUA 2.3.2, this location cannot be moved after LUA is installed. The copies kept here are used to distribute the materials to all the Distribution Centers (DC’s) as needed.
  3. The “Distribution Center.” This is where Symantec products come to collect what they need.  The default DC is called “clu-prod” and it is on the same C drive.  A LUA server can have up to 100 DC’s all throughout the network. 

    and sometimes:

  4. Add one more, as well, if the optional "clu-test" Testing Distribution Center is used as well.

Some additional info can be found in the following article, and the articles linked from it:

Is it Possible to Configure LiveUpdate Administrator 2.x Download Directory Locations?
Article URL http://www.symantec.com/docs/TECH138380 

Today's AntiVirus signature files are very large in order to protect against the millions of known threats.  So, these updates that LUA stores can consume quite a bit of space. The figures in the following article date from 2010, but provide a rough estimation: 

How much hard disk space is consumed by LiveUpdate Administrator 2.x for content updates?
Article URL http://www.symantec.com/docs/TECH90823

If space is growing short on the drive where LUA is installed, here are a couple of recommended actions:

  • Many customers who are running out of space have added a new disk or virtual disk and used that for TempDownloads.  This reduces the burden that LUA places on the C drive.
  • Another solution: there’s no requirement to use this default clu-prod. One definite way to reduce the amount of space needed on the C drive would be to establish a DC on a different server that has ample space, then configure the various Symantec products to retrieve their updates from there.  Details of how to do this can be found in the Connect Forum article and video on LiveUpdate Administrator: How to configure a remote Distribution Center
  • Don't use one overloaded LUA server to download all the products that the entire organization needs.  If server capabilities are very limited, dedicate one LUA for SEP updates, another LUA server for Scan Engine and so forth.
  • Also: determine if LUA is actually configured to download what the organization needs, and no more.  Read on.....


What is Taking Up So Much Space?

LUA 2.x can locally mirror everything that is on Internet-based LiveUpdate source servers.  That is an enormous amount of materials.  A common misconfiguration is just to "check" the entire product family when determining what LUA will download and distribute. 

The good news is that LUA allows excellent granularity.  If, for example, a company only uses the AntiVirus capabilities of SEP in their organization, LUA can be configured to download just the AV contents- saving many, many GB worth of materials that would never be used.  Here is an illustration of what to check (and leave unchecked!) in an organization of 32-bit SEP clients which retrieve their AV defs directly from the LUA server:


The following resources can help admins to determine how best to configure their LUA:

LiveUpdate Administrator 2.x: What product selections are needed for specific versions of Symantec Endpoint Protection?
Article URL http://www.symantec.com/docs/TECH139618

LiveUpdate Administrator: Product Selection Guide

It requires experience to recognize corresponding product and purpose of the files that LUA downloads and distributes.  If, when examining the file system, there is ever a question about what a file is and does (and whether or not it is supposed to be present!) use LUA's "Manage Updates" page.

How To Determine the Corresponding Product for a LiveUpdate Administrator 2.x File
Article URL http://www.symantec.com/docs/TECH131177


Why is there one larger-than-normal download every month?

A set of current monthly based definitions (sometimes called "hub," "full" or "error" definitions) are published once per month for AntiVirus products (SEP 11 and Symantec AntiVirus 10.1). Note that there are separate hub defs for Macintosh, 64-bit components, and 32-bit components.  LiveUpdate cannot operate without them, so the LUA server always downloads these large full definitions once per month.  (These "hub defs" are usually released on the Tuesday that is closest to the 15th of the month.) 

Some examples of SEP Hub-to-Hub defs:

  • 1326744606jtun_nav2k8enn12m25.m25
  • 1326744606jtun_nav2k8enn11m25.m25

An example of SEP Full defs:

  • 1326744606jtun_nav2k8ennful25.m25

Some examples of SEP for Mac full defs:

  • 1321438723jtun_ennfull2v2.osi
  • 1321438723jtun_ennfull2v2.osx

Additional details on how LiveUpdate works to update AntiVirus clients (and the various types of files it uses) can be found in the following articles:

Symantec Endpoint Protection 11.x LiveUpdate "Micro Definition" Updates Explained
Article URL http://www.symantec.com/docs/TECH180196 

LiveUpdate Administrator disk space usage is increasing in time even though purge is enabled and apparently working as expected.
Article URL http://www.symantec.com/docs/TECH186728 

What does an unmanaged Symantec Endpoint Protection 11 client retrieve from LiveUpdate for its definitions
Article URL http://www.symantec.com/docs/TECH169751  

Shouldn't LUA Purge Old Files?

In a word: yes, it does.  Here is an extract from the User Guide which describes how purging and revision management are designed to work:

Configuring LiveUpdate Administrator preferences
You can also set schedules and rules for purging older updates, both in the Manage Updates folder and in Distribution Centers. When you download updates, they are copied to the Manage Updates location that you specified during installation. LiveUpdate Administrator distributes updates to your Distribution Centers, where they remain until you remove them. You can purge old updates from your Distribution Centers to free disk space. By default, updates in Distribution Centers are purged daily. However, you can change this setting to never purge updates automatically, or to purge them monthly or weekly.

All updates in the Manage Updates folder, except for the latest three revisions, are set to be purged daily by default. However, you can specify rules for the Manage Updates folder purge to determine which updates to delete, based upon the age of the revision or when the updates were initially downloaded. For example, you can purge updates older than 10 revisions back or purge the updates that were downloaded more than 10 days back.

Note: Even with a single content update revision, LiveUpdate Administrator can typically provide incremental content updates to connecting clients that have content outdated for up to 12 months.

Typically, Symantec recommends that you configure LiveUpdate Administrator to store no more than three update revisions. The primary reasons are to ensure that it is possible to rollback to a previous version of content in the unlikely event of corrupted content or a false positive, while also minimizing disk space usage.

A purge does not delete the latest revision even if it satisfies the purge rule. For example, a revision may be more than 10 days old, but it is not deleted if it is the latest revision.

Purging in LUA does not operate in a similar way to "keeping X number of content revisions" in a SEPM.  Some files which can seem very old are retained by LUA.  This is by design: LUA mirrors Internet contents, rather than creating deltas.  As certain content updates rarely change, the initial files will be the most recent release available even though they date back several months.  An example: SESM AntiVirus client update files. 

  • Tuesday, February 22, 2011 1:59 PM 15025400 1256246532 jtun_sesmantivirusclientwin32_1567to333_20090918437_51903.zip
  • Tuesday, February 22, 2011 1:58 PM 12113593 1256246532 jtun_sesmantivirusclientwin32_19to333_20090918984_51174.zip
  • Tuesday, February 22, 2011 1:58 PM 13136468 1256246532 jtun_sesmantivirusclientwin32_2224to333_20090918765_46396.zip

Using "Manage Updates" can display when a particular file or product last updated a component.

Also: examine the LUA Event Log for any errors regarding "Distribution Center Cleanup," "Purge Schedule" and "Delete Content."  These errors can take place in the event of LUA database corruption, failure to delete files that were locked by other processes, etc.

Can Files Be Purged Manually?

Though Windows will allow it, it is NOT recommended to manually delete files that are in LUA's TempDownloads, Manage Updates and Distribution Center locations.  Doing so will throw the LUA database out of alignment with what is present on the disk.  In case this has been done, please read:  

What to do if you have Manually Deleted Files from a LiveUpdate Administrator 2.x Distribution Center?
Article URL http://www.symantec.com/docs/TECH132036

An "emergency purge" option may be added to a future release of LUA.  There is a Connect Forum "Idea" (proposed enhancement request) that can be supported by those who wish to voice their interest in such an option: "Purge Now" Button for LiveUpdate Administrator 2.x

The best current solution, if it is strongly believed that an existing DC contains files that it should not:

  1. Backup the LUA 2.x server's settings
  2. Backup the contents of the DC
  3. Delete the DC in LUA's Configure / Distribution Centers GUI
  4. Afterward, re-create the DC with the same location, name, etc

This will wipe out all of the current contents and replace them with only the current, known-good, valid materials from the LUA server's Manage Updates directory.

Additional Information

There are a number of proposed changes to the way that LUA handles its content.  Admins may wish to cast a vote in support of the following enhancements to the way LUA manages updates and displays information about them:

Additional suggestions from LUA admins can be created in the Ideas.  Please do contribute any suggestions for improvements you would like to see in a future release!


Many thanks for reading!  Please do leave comments, below, if you find this article helpful or unhelpful. 


0 Favorited
0 Files

Tags and Keywords


Jul 15, 2014 04:33 AM

Just adding a note: LiveUpdate Administrator 2.3.3 is now available!

Downloading LiveUpdate Administrator


LiveUpdate Administrator 2.3.x Release Notes


Apr 01, 2014 04:32 PM

GR8 article yes

Sep 14, 2013 05:49 AM

Subscribers of this articles may find the below article of use as well:


Knowledgebase Articles for Liveupdate Administrator (LUA)


Sep 12, 2013 01:24 PM

Thanks for the info.  I'm just starting to look in LUA 2.3.1 and this would be very helpful.

Sep 11, 2013 09:34 AM

Just adding another important cross-ref:

LiveUpdate Administrator 2.x Server Connection Recommendations

Aug 29, 2013 09:16 AM

Nice Article  yes

Jun 05, 2013 08:09 AM

Thanks for Sharing


May 17, 2013 05:25 PM

thank you, I was looking for exactly this solution for izrada web stranica

May 17, 2013 12:00 PM

Just adding a cross-ref to another good LUA article:

A Helpful LiveUpdate Administrator 2.x Analogy

Apr 25, 2013 03:35 AM

Thanks for sharing the valuable infromation.

Sep 11, 2012 09:53 AM


This is an Article on for every LUA Administrator to go through..Truely Awesome. +voted.

Sep 07, 2012 10:41 AM

Here is a new article that may be of interest to LUA administrators:

How Big are Current Symantec Endpoint Protection Definitions?

Jun 29, 2012 02:20 AM


Mar 19, 2012 12:43 PM

Hi Mritunjayksingh,

The LiveUpdate Administrator 2.x serevr uses PostgreSQL as its database, not the SEPM's iAnywhere embedded database.  You would be best creating a new thread in the Connect forums for your issue, supplying as much information as possible.

Hope this helps!


Mar 19, 2012 04:22 AM


Embaded database service is not showing in windows services pls .

Mar 16, 2012 02:41 PM

Thank you mick2009

This helped me a lot.

Feb 09, 2012 04:05 AM

LUA 2.x is often found on the product CD/DVD, though I recommend contacting Tech Support for details on how to download (free!) the latest available release.  They will provide instructions for how to download the latest version.

What is the latest version of Symantec LiveUpdate Administrator 2.x (LUA 2.x)?
Article: TECH134809   |  Created: 2010-01-09   |  Updated: 2011-12-21   | 
Article URL http://www.symantec.com/docs/TECH134809 

Feb 09, 2012 01:31 AM

It comes with the installation package. You can download it from the fileconnect website.

Feb 08, 2012 02:00 PM

Where can customers download Liveupdate Administrator?

Jan 23, 2012 06:37 AM

Good one.

Jan 17, 2012 11:06 AM

Vey Good article. Thank you. I shall bookmark this one

Jan 17, 2012 04:36 AM

Awesome article ! :-)

Jan 09, 2012 03:34 PM

Nice condensed article with LUA information.

Jan 08, 2012 10:46 PM

One of the great articles that I have read on LUA.

Jan 03, 2012 09:50 AM

excellent stuff, thumbs up!

Related Entries and Links

No Related Resource entered.