Endpoint Protection

Hi,

We have a LU server which we use to distribute SEP11 definitions to certain computers however this has stopped working.

I have 3 download schedules all of which fail. They are set to run overnight when the network is at its quietest however they still fail.

I'm not too experienced with troubleshooting this product so can anyone help me out?

Cheers.

Hi, 

Kindly try the steps below:

• Open Control Panel -- > Symantec liveupdate. 
• Change the mode to interactive and error support to enhanced. 
• Click on ok to all.
• Start -- > Run -- > Luall.exe
• On the first screen you will get the list of products, check for Antivirus definitions 32 and 64 bit. 
• Follow the wizard and observe the errors if you get any.

Thank you. 

I've followed your insturctions however I'm not sure what relevance they have as the product which has the problem is Live Update Administrator (server).

This server has SEP 11 installed but does not update form the live update server. It updates from the central management server (SEPM) and as such LU reports that the product is up to date.

Kindly check if there are any failure in downloads of the LUA. 

Hello,

this is exactly what this thread is about! The downloads in the live update administrator is failing. Well, 3 of them are failing as I have set 3 download schedules... all of which fail!

you have any proxy or firewall in your network?

what if u remove all the schedules and them again as fresh, does that work?

Hi, 

We have multiple reported issues with LUA download failing. There is one defect id created for the same as well. I am not sure whether you are also facing the same issue. I would recommend you open up a case with support in order to further troubleshoot the issue and get it verified. 

Regards, 

Hi,

We do have firewalls however this has never been a problem for internet downloading and nothing has changed on this front. The download does start and gets well into the download but then fails.

I havent tried removing and re-adding the schedules but will give that a try.

I have tried a manual download request as well which failed.

are u able to do this ?

http://service1.symantec.com/SUPPORT/sharedtech.nsf/docid/2003090514252213

Hi,

I've done this and the firewall is not a problem. I have also deleted all download schedules and created only one this time. Started a download and if failed at 82%

remember one issue, can you post the liveudpate.log file?

can u set this  value and try downloading a new one??

set PREFERENCES\DISABLE_SEGMENTED_DOWNLOADS=YES in Application Data\Symantec\LiveUpdate\settings.liveupdate.

https://www-secure.symantec.com/connect/forums/liveupdate-seems-be-broken

Where can I find the  liveupdate.log file?

I have looked in the settings.liveupdate file however PREFERENCES\DISABLE_SEGMENTED_DOWNLOADS does not exist in this file. Should I add this line in?

that was for sepm, without LUadmin

lets add that line, take a backup of original settings files, lets try this  , even i'm curious :)

OK. I've made the change and reboot the LUA server and started the download. I'll post results when i get them.

One thing I noticed is that LUA takes a long time to start the download and also takes a long time to show recent activity on the home page. I clicked the run now button and it takes more than 2 minutes to get to the next screen. Just wonder if this could be related?

Just to update. The download failed only this time it was right at the start. Around 2%.

I recently had a similar issue which was resolved with the following steps:

From the manager (SEPM) which had the updates failing:

Verify Live update verison installed (to redownload what you have_) I had 3.3 installed

Reinstalled live update 3.3
ftp://ftp.symantec.com/public/english_us_canada/liveupdate/3.3.0/

Select the lustep.exe  in all lower case

Log into the SEPM
Open CMD Prompt
 

Change your directory to match the drive letter you have the manager installed to:

For example: "D:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin"

Run the following two commands:

D:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin\lucatalog -cleanup

D:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin\lucatalog -update

Launch luall.exe from run command 

This resolved my issue. Best of luck. Appears LU was corrupted.

Hi,

This isnt realy relivant as the problem was with Liveupdate Administrator and not Liveupdate.

Apologize. Did that edit to the file (Settings.liveupdate_) work for you?

No. Tried 3 times now however its still failing.

Not sure if this could be the issue or that your fix just is not applicable to the problem. Did you notice that Settings.LiveUpdate is a read-only file. Right-click on the Settings.LiveUpdate file and uncheck the read-only property before editing.

 

Hi Aeropars,

I think I can help.

>I have 3 download schedules all of which fail. They are set to run overnight when the network is at its quietest however they still fail.

Are these updates failing with reports of "Corrupt" files seen in Activity Monitor?  When opening up the lua-application logs with textpad or notepad, can you find some "Package is not trusted" errors?  This article probably describes what you are seeing:

Intermittent "Package is not trusted" errors for various product update files during LiveUpdate Administrator 2.x download phase (http://www.symantec.com/docs/TECH141217)

Try out the workarounds that are listed in that article ("Tuning lua_static.properties")- they have helped many admins.  Also, the good news is that the new LUA 2.3, which will contain a longer-term fix, is expected to be released within one month.  This new release has many additional improvements and performance enhancements: it will be a "must have" for all LUA 2.3 users.

Please examine your server's logs, and try those workarounds if it is this issue.  Keep the forum up-to-date with your progress and let teh community know if this has solved it for you!

Thanks and best regards,

Mick

Hello Mick,

I do see that within the log file so have made the changes you suggested. I'll report back with the results as soon as I get them.

Thanks

Hi Mike,

I lowered the max.segmented.pool.size to 10 but this still failed. I've dropped it down to 3 and am running a test again. I'll let you know the outcome.

Thanks

Excellent- thanks for the update, Aeropars!

If the trouble continues even with the number of simultaneous downloads set to a low number like 3, there's a trick or two up my sleeve that may help. 

For that, though, I would need some diagnostic info from that server: just a matter of opening a quick case with Tech Support and taking the investigation through those usual channels. Anyway, keep teh thread up-to-date with your progress and let me know how you get on!

Thanks again,

Mick

Thanks Mick. The download is still going although its only at 24% now.

I have a support account but how would I log it so that you receive the call?

Regards

Hi Mick. Im afraid it still failed this tiem at 92%

Hi again,

It's best to just open a case via the usual method- once you get in touch with the Technical Support Engineer, just let them know that you have been actively working on this known issue in this connect forum thread.  Once you have a case number, please let me know it by Personal Message and I will get in touch with the case owner and work with that TSE.

Here are articles about two diagnostics that the TSE will need you to run on your LUA server:

How to Collect Troubleshooting Information from LiveUpdate Administrator 2.x  (http://www.symantec.com/docs/TECH92654)

The Symantec Endpoint Protection Support Tool (http://www.symantec.com/docs/TECH105414)

A quick look at those materials should enable me to tell exactly what's going on "under the hood" and if the adjustment that I hope to make would work in your case.

Thanks again,

Mick

(Please note: this invitation to PM me a case number is open exclusively to Aeropars, only for this one issue.  In all other instances, please get in touch with Tech Support through usual channels.)

Thanks for that- I've put a note in the case for the TSE who will own it.  They will get in touch with detaisl of what exact files we need to have a look at.

One question: what were you trying download when the job failed at 92%?  Was it completely everything that was out of date on the LUA server, or one selected component?

You may wish to try a manual download of one individual component (for example, SESM 32 bit definitions) and see if that succeeds.  If so, try to take the job of getting the LUA server up-to-date in steps.  That way if one file reports a failure, you've not lost all updates from all components currently in the download job.

Thanks Mick,

I've started the collection of troubleshooting info using thelocal URL of the debig script however its taking a very long time. Been running for about 10 minutes so far!

I have been downloading everything to do with SEP although the point in which it fails differs on each download. some times it can fail at 2% and other is gets almost to the end, it seems totally random!

I've just tried a manual download of the part you suggested however it says there are no new updates for this. It that likely to be correct or is it reporting wrong?

Also, I have checked the clients which are using this however it seems they are up do date with definitions. I'm confused now!

Try some other individual components out as well- are they reporting that they are up-to-date or do you see the activity monitor which means they are downloading now?

I expect that individual manual updates of selected SEP components will succeed.  Give it a try!

OK, will do!

How long should the debug (http://127.0.0.1:7070/lua/debug.do) take? I'm starting to think its not going to end!

I have examined the logs from your LUA server and can confirm that this is an example of this known issue.  the good news is that LUA 2.3, which will fix or greatly improve the matter, should be available within a month.

There are several other observations and recommendations: the case owner will be in touch directly/privately about those.  But in teh short term: keep the tuning the way you have changed it tody, and get the SEP components up to date one by one.  Once they're all up-to-date, I expect that the daily downloads will be small enough to run all at once.   If they do fail, then a manual retry should get them successfully.

Thanks again, Aeropars!  Hope this helps you and any other forum visitor encountering the same issue!

With best regards,

Mick 

Hi again,

Glad to learn that the LUA server is working for you at present- for improved performance, greater usability etc please do upgrade to LUA 2.3 when it becomes available.

And please do continue to use the connect forums for any future issues for which assistance is required! 

Thanks again and best regards,

Mick