SEPM unable to download updates

[Migration User]

Hi All,

Good Day!

We are facing an issue with downloading updates from the LUA server. We have two SEPM servers that are configured to download updates from two LUA servers (Primary and Secondary). The update does not happen on one SEPM server while it works fine on the other. When I run the live update it runs properly but the update does not happen.

Connectivity between the SEPM servers and LUA servers are fine. I am able to telnet on port 7070 and I can even access the LUA server http://luaserverhostname:7070/clu-prod. 

I also tried Start --> Run --> luall.exe. This also did run properly but the update did not happen. 

SEPM version:  12.1

LUA version: 2.3.2.99.

 

I would really apppreciate if any one could help me with this.

Thank you.

Faiz

 

[Ambesh Sharma]

 

Hi,

What's new in LiveUpdate Administrator 2.x

http://www.symantec.com/docs/TECH171578

Best Practices for LiveUpdate Administrator (LUA) 2.x

http://www.symantec.com/docs/TECH93409

When to use LiveUpdate Administrator?

http://www.symantec.com/docs/TECH154896

A Helpful LiveUpdate Administrator 2.x Analogy

https://www-secure.symantec.com/connect/articles/helpful-liveupdate-administrator-2x-analogy

How Big are Current Symantec Endpoint Protection Definitions?

https://www-secure.symantec.com/connect/articles/how-big-are-current-symantec-endpoint-protection-definitions

Managing LiveUpdate Administrator 2.x Space Usage.

https://www-secure.symantec.com/connect/articles/managing-liveupdate-administrator-2x-space-usage

How to backup and restore LiveUpdate Administrator (LUA) configuration in LUA 2.3

http://www.symantec.com/docs/TECH159239

How to Collect Troubleshooting Information from LiveUpdate Administrator 2.x

http://www.symantec.com/docs/TECH92654

How to Export the LiveUpdate Administrator 2.x Server Event Log

http://www.symantec.com/docs/HOWTO61146

LiveUpdate Administrator 2.x Server Connection Recommendations

https://www-secure.symantec.com/connect/articles/liveupdate-administrator-2x-server-connection-recommendations

[Migration User]

What is the exact SEPM version? Is the other (working) SEPM on the same version? Do you see any download errors while running the liveupdate session on SEPM?

[Migration User]

Hi Sebastian,

The exact SEPM version is 12.1 RU1 MP1. 

Both the SEPM are running the same version.

While running the live update it says no update found and in the end it says LiveUpdate succeeded. I am attaching the screenshot for reference.

Thank you.

Faiz

[Migration User]

Can you post the logliveupdate.log from this SEPM?

 

You mentioned above 2 LUA Servers (Primary and Secondary) - what is the exact communication here - is it like this?

- are SEPM 1(bad) updates not working for both LUA Primary and Secondary?

- are SEPM 2(good) updates working for both LUA Servers?

[AjinBabu]

Hi, 

Weather your LUA server having the latest Updates?

And try to remap to the working LUA and try to download?

Regards

Ajin

 

 

[Rafeeq]

Please post the log.liveupdate

http://www.symantec.com/business/support/index?page=content&id=TECH105924

[Migration User]

Hi All,

I am sorry for the confustion. Let me clarify how the set up is.

Both the SEPM servers are configured to download the updates from one LUA server. The other LUA server is configured as secondary in the list. 

Now, one SEPM server is unable to successfully download the updates from the LUA server where as the other SEPM server is able to download the updates successfully from the same LUA server.

I presume that it is a problem with the SEPM server and not the LUA server. Also I tried changing the priority of the LUA server to the secondary one in the problematic SEPM server. But, that also did not help.

I am attaching the Log.LiveUpdate for reference.

Thank you,

Faiz

Attachment(s)

Log_20.zip   316 KB 1 version

[Rafeeq]

No problem with your LUadmin or sepm.

3/19/2013, 14:24:45 GMT -> EVENT - SESSION END SUCCESSFUL EVENT - The LiveUpdate session ran in Silent Mode. LiveUpdate found 6 updates available, of which 6 were installed and 0 failed to install.  The LiveUpdate session exited with a return code of 1800, Success

 

open liveupdate policy, there is tab called live update content on the right side. right click on that and select edit.

what date do you see for your AV/AS. sonar and ntp will not be updated everyday.

do you have anyother symantec product installed on same machine?

 

[Migration User]

What are the versions of the AV definitions you see available on both SEPM Server?

You should be able to compare in Admin-> Servers-> Local Site-> Show liveupdate downloads

[Migration User]

Hi Sebasitan,

I see the version 02/28/2013 r17 on the problematic SEPM server and 03/19/2013 r18 on the other SEPM server. 

When I compare the LiveUpdate downloads they are showing diffrerent versions and dates.

 

Dear Rafeeq,

 

When I open up the LiveUpdate content I see the below screenshot.

My AV/AS date is 02/28/2013 r3 and I understand SONAR and NTP will not be updated daily.

I have SEPM and SEP client installed on the server.

Thank you

Faiz

[Rafeeq]

For the last time, from the screen shot  can you click on select a revision and check if latest def is available. is there a replication between these two SEPM servers?

[Migration User]

From the settings it seems to be fine - cannot find any errors here. Best bet now - try to reinstall the Liveupdate on this SEPM:

1. Remove Live update from "Add/ Remove Programs"
2. Reboot the machine
3. In Windows Explorer, if they are present delete the following folders, without saving the existing content:
- C:\ProgramData\Symantec\LiveUpdate
- C:\ProgramData\Application Data\Symantec\LiveUpdate
- C:\Program Files (x86)\Symantec\LiveUpdate
4. Install LU using lusetup.exe (execute with local admin rights - build in administrator)
5. in C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin:
- Type lucatalog -cleanup and press Enter.
- Type lucatalog -forcedupdate and press Enter.
6. in  C:\Program Files (x86)\Symantec\LiveUpdate start luall.exe (execute with local admin rights)

[Migration User]

Hi

Please reinstall the liveupdate

Regards

 

[Migration User]

Hi Sebastian,

I followed your steps and still no luck.

It gave an error when I did luall.exe. It said some update are corrupt and re-run the liveupdate.

When I checked the downloads, i found the following

But when I run the liveupdate from the SEPM console it gives the error "LiveUpdate encountered one or more errors. Return code = 4" and then liveupdate failed.

Request your assistance.

Thank you

Faiz

[Rafeeq]

do a repair of sepm it will re-register the LU component. Delete all the old liveupdate log.  run the update and attach the new one. 

worth giving a try by cleaning definitions as per this article

http://www.symantec.com/connect/articles/how-clear-corrupt-virus-definitions-sepm

[Migration User]

In that case try if updating the SEPM manually with .jdb intelligent update:

http://www.symantec.com/docs/TECH102607

Have a look here as well:

http://www.symantec.com/docs/TECH183178

[Migration User]

Hi All,

Appreciate your assistance. The issue has been fixed. 

Since the SEPM server is downloading updates from LUA servers, it did not have direct internet connection. It was going through Proxy to the internet. 

I reinstalled the LiveUpdate and then provided direct internet acccess for the SEPM server. Then I run luall.exe and it downloaded all the updates successfully.

However, once I removed the direct internet access it was again giving the same error "LiveUpdate encountered one or more errors. Return code = 4" while performing a liveupdate from SEPM console.

I then found the following link http://www.symantec.com/connect/forums/liveupdate-express-issue. Accordingly I replaced all the Product.Inventory.LiveUpdate files with the same files from the secondary SEPM server. 

Though it is strange, everything went well and the liveupdate did run successfully. I observed it for one day and now it is downloading the updates successfully. 

I have one more query here. 

When I compare the downloads on both the servers I see a lot of additional components in the one that was having problem. Below are the screenshots:

Please let me know if this would cause any issue as the contents are different. 

Thank you.

Faiz

 

[Migration User]

Repair the SEPM and check.

[Migration User]

Hi,

Prior to doing all the above steps, did a repair but it failed. Did not work.

Thanks

Faiz

[Rafeeq]

in sepm

under admin

servers 

liveupdate, check what components you have selected. compare this with the other one.

 

[Migration User]

Hi

Try reinstall the LUA

Regards

 

[Migration User]

Hi Rafeeq,

I compared the components and they are the same. 

Moreover, I see that the issue has come back. It is now showing two days old version and liveupdate is giving the same result. It says the update is successful but it is not. 

I am stuck. Please assist as I need to fix this in two days..!!!

Thank you,

Faiz

[Rafeeq]

Open services.msc

under Liveupdate tab log on. Do you see a system account or any logged in admin account.

seems like the automatic scheduling is not working ,however a manual liveupdate works.