Why have LiveUpdate Virus Def Downloads increased in size starting Jan 2010 ?

[Migration User]

Does anyone know why starting in Jan., around the 9th, the size of the SESC Virus Defs W32 V11 downloads using LiveUpdate Administrator started increasing, going from being typically 20M, to averaging over 100M, every day ? Not to mention why it is failing so much.

 

In the past, about 1-3 times a month I would get sizes of 500M, and when I asked Symantec they told me these were Symantec Engine updates, but now for some reason starting last month, every day the sizes are large. This is a problem for me because I have a 5 gig monthly limit, and at the rate of these downloads, I will blow that limit easy and then have to pay .05/Meg, which adds up quickly.

 

I upgraded to the most current LiveUpdate Administrator, 2.2.2.9, hoping maybe that would solve my issue, but nothing has changed. Last night the download was only 74M, but it failed at around 40M, and LUA doesn't have restart capabilities, so if I restart it, it re-downloads what it already had before the failure. Failures happen quite often, sometimes as much at 50% of the time.

 

Here are the downloads since the problem started. Keep in mind every time it fails, it may have downloaded 50, 100, or 400M, just chewing up my monthly allowance.

 

Times are 24H CST

 

02/03 01:02:38-01:16:38   74M     Failed

02/02 01:02:33-01:28:15   154M

02/01 01:02:18-01:24:30   151M

01/31 13:58:12-14:27:10   166M    UPGRADED LUA HERE    Went to other site with un-limited usage in fear of 500M or more file

01/30 19:01:37-19:06:38   160M  

01/30 14:24:16-14:30:34   144M  

01/30 01:02:20-01:19:10   166M    Failed  

01/29 00:03:14-00:38:47   160M    Failed  

01/28 00:07:17-00:42:27   162M

01/27 00:02:59-00:39:09   156M    Failed  

01/26 Disabled

01/25 Disabled

01/24 14:10:06-14:26:18   712M    Went to other site with un-limited usage

01/23 Disabled

01/22 Disabled

01/21 Disabled task because monthly usage is at 50% and have 19 days to go

01/20 00:05:48-00:59:04   725M    Failed  

01/19 00:02:24-00:48:55   247M    Failed  

01/18 00:06:29-00:52:02   195M

01/17 00:02:54-00:48:48   160M    Failed  

01/16 00:06:22-00:46:24   173M    Failed  

01/15 00:02:25-00:13:04   83M

01/14 00:06:35-00:26:44   77M

01/13 00:02:19-00:23:25   84M     Failed

01/12 00:03:13-00:21:35   39M

01/11 00:03:17-00:13:00   38M

01/10 00:03:13-00:24:47   67M

01/09 00:02:28-00:38:01   60M     Failed

01/08 00:05:23-00:17:46   18M

01/07 00:02:24-00:11:02   16M

01/06 00:06:04-00:12:00   21M

01/05 NO UPDATES

01/04 00:06:53-00:14:14   30M

01/03 NO UPDATES

01/02 00:06:00-00:12:37   24M

01/01 00:02:27-00:12:25   26M

[Migration User]

 As this issue got fixed the size increased. 
https://www-secure.symantec.com/connect/forums/official-status-sepm-definitions-stay-31-12-2009-last-updated-04-jan-2010

[Migration User]

It may be inter realted with


Title: 'Security Content for Symantec Endpoint Protection clients and Symantec Endpoint Protection Managers are dated Dec 31 2009 even when using the latest definitions'
Document ID: 2010010308571348
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2010010308571348?Open&seg=ent

[Rafeeq]

well we had issues with def date and its fixed now,hope the patch is already installed on your environment.

i would suggest you to check only those you require in the downloads section of your LUAdmin.
if you environment dont have 64 bit clients you can skip that download
simillary select your products and what to download.

LiveUpdate Administrator 2.2: What product selections are needed for specific versions of Symantec Endpoint Protection

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/434f5a6ff8750105882574de006badf9?OpenDocument
https://www-secure.symantec.com/connect/forums/lu-admin-and-64-bit-packages

[Migration User]

I'm not sure what you are telling me. Are you saying the size of the downloads will always be large from now on ? If this is the case,  I have to look for a new product.

[Migration User]

The only items I have selected in the Schedule that has increased 8 times over are the following:

SESC Virus Definitions Win32 V11
SESM Virus Definitions Win32 V11

[Migration User]

 Recently there was also a Scan Engine update..So I think it should get down now..
If its not then it might be some issue with LUA .

[Migration User]

I do remember that the first week at least in Jan. the date never changed from 12/31/2009, but that was resolved. All my systems show the most current date for defintions, however in SEPM it still says the "Latest Manager Version" is 2009-12-31 rev. 174. Is this a problem ?

I do appear to have the fix for this on my system, however, I can't be sure, but I think the problem with the sizes increasing may have started about the time the fix was  applied. I'm assuming it part of one of the SESM downloads ? When was the fix available ? Could this have caused the problem ?

[Migration User]

If you look at my orig post and the download activity, on the 20th the size was over 700MB, so I am assuming that this was the Scan Engine update, which I did finally get downloaded, but the problem started before this, and it has continued even after updating LUA to 2.2.2.9.

[Migration User]

If there isn't much to configure ( distribution ) why don't you try wiping it out and starting fresh. 

[Migration User]

Are you talking about just the distribution server ? Why would it cause the downloads to be large ?


Is there an easy way to do that without having to un-install LUA and re-Install it ?

[Migration User]

 It has nothing to do with distribution list .
Just wanted to say if you do not have much configuration done in LUA then why don't you try re-installing LUA.

So just clear out the downloads then see how it goes
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate Administrator\Download
and
C:\Program Files\Symantec\LiveUpdate Administrator\clu-prod

[Migration User]

Ok, here is what I did. So I didn't disturb my production LUA Server, I installed LUA 2.2.2.9 on a different machine. I've probably installed LUA a dozen times by now and know that the first time downloading is usually around 500MB. What was interesting this time was that it was actually 1.2GB. And this is only selecting SESC Virus Definitions Win32 V11 and SESM Virus Definitions Win32 V11 .

So, I got the new LUA install primed, distributed the defs and actually configured my prod LUA server to download the defs from that distribution server.

I then did the subsequent downloads for SESC Virus Definitions Win32 V11 and SESM Virus Definitions Win32 V11 from the new LUA server.

They are still 170MB, so I guess this didn't fix the issue.

I need to get this resolved or I will be forced to find a different solution for this site.

There has to be a reason the download sizes for SESC Virus Definitions Win32 V11 and SESM Virus Definitions Win32 V11 have increased from an avg of 20MB to 160-170MB. It started around Jan 9th or so and was before I upgraded LUA.

Is it possible that the code to only select what the user wants is broken and it is downloading a lot more than what I want ?

[Migration User]

 I would suggest opening up a case with Symantec.