GUP (Group update Priver) running crazy. Has anyone seen something like that before?

[Migration User]

Hi,

our GUPs went crazy. The since a few days the make starnge traffic to all clients. Thes GUP has only a few clients, less than 10. Since a week we see this Traffic, monitored on the network interface. The clients will not be updated. After a while everything is O.K.
Some Signature updates work, sometimes not. I am not sure where to find the problem.
When I disable the GUP, the clients switch to the SEP-M and everything is fine.

The settings for the bandwidth throttling also does not work in any way. ggrrrr.

nearly all clients are RU5, GUP is RU5

All GUPs have the same issue!
Deleting the 0 kb TMP file on the client will not solve the issue!

any more ideas?

Sylink log:

11/26 17:49:49 [3396] <SetupTempLUFilePath:>NEW download: C:\Program Files\Symantec\Symantec Endpoint Protection\LiveUpdate\LUF{C60DC234-65F9-4674-94AE-62158EFCA433}91125048911250327.TMP<o p=""></o>

11/26 17:49:49 [3396] <CHttpFileDownload::CHttpFileDownload()><o p=""></o>

11/26 17:49:49 [3396] </CHttpFileDownload::CHttpFileDownload()><o p=""></o>

11/26 17:49:49 [3396] <CHttpFileDownload::Do()><o p=""></o>

11/26 17:49:49 [3396] <CHttpFileDownload::getRemainingBytesToDownload()><o p=""></o>

11/26 17:49:49 [3396] Remaining bytes to download: 113149<o p=""></o>

11/26 17:49:49 [3396] </CHttpFileDownload::getRemainingBytesToDownload()><o p=""></o>

11/26 17:49:49 [3396] <CHttpConnector::SendRequest()><o p=""></o>

11/26 17:49:49 [3396] Request> http://10.187.51.89:2967/content/{C60DC234-65F9-4674-94AE-62158EFCA433}/91125048/xdelta91125032.dax<o p=""></o>

11/26 17:49:49 [3396] Unable to query return content length for SendRequest, 122<o p=""></o>

11/26 17:49:49 [3396] </CHttpConnector::SendRequest()><o p=""></o>

11/26 17:49:49 [3396] <CHttpFileDownload::read()><o p=""></o>

11/26 17:49:49 [3396] </CHttpFileDownload::read()><o p=""></o>

11/26 17:49:49 [3396] </CHttpFileDownload::Do()><o p=""></o>

11/26 17:49:49 [3396] <LUDownloader::GetContentToFile> completed. <o p=""></o>

11/26 17:49:49 [3396] <CHttpFileDownload::~CHttpFileDownload()><o p=""></o>

11/26 17:49:49 [3396] </CHttpFileDownload::~CHttpFileDownload()><o p=""></o>

11/26 17:49:49 [3396] <LUThreadProc>@@@@@@@@@ LU DEBUG ONLY- Download file failed due to wrong file size. <o p=""></o>

 FileName:C:\Program Files\Symantec\Symantec Endpoint Protection\LiveUpdate\LUF{C60DC234-65F9-4674-94AE-62158EFCA433}91125048911250327.TMP Expected file size: 113149<o p=""></o>

11/26 17:49:49 [3396] <SetupTempLUFilePath:>NEW download: C:\Program Files\Symantec\Symantec Endpoint Protection\LiveUpdate\LUF{C60DC234-65F9-4674-94AE-62158EFCA433}91125048911250327.TMP<o p=""></o>

11/26 17:49:49 [3396] <CHttpFileDownload::CHttpFileDownload()><o p=""></o>

11/26 17:49:49 [3396] </CHttpFileDownload::CHttpFileDownload()><o p=""></o>

11/26 17:49:49 [3396] <CHttpFileDownload::Do()><o p=""></o>

11/26 17:49:49 [3396] <CHttpFileDownload::getRemainingBytesToDownload()><o p=""></o>

11/26 17:49:49 [3396] Remaining bytes to download: 113149<o p=""></o>

11/26 17:49:49 [3396] </CHttpFileDownload::getRemainingBytesToDownload()><o p=""></o>

11/26 17:49:49 [3396] <CHttpConnector::SendRequest()><o p=""></o>

11/26 17:49:49 [3396] Request> http://10.187.51.89:2967/content/{C60DC234-65F9-4674-94AE-62158EFCA433}/91125048/xdelta91125032.dax<o p=""></o>

11/26 17:49:49 [3396] Unable to query return content length for SendRequest, 122<o p=""></o>

11/26 17:49:49 [3396] </CHttpConnector::SendRequest()><o p=""></o>

11/26 17:49:49 [3396] <CHttpFileDownload::read()><o p=""></o>

11/26 17:49:49 [3396] </CHttpFileDownload::read()><o p=""></o>

11/26 17:49:49 [3396] </CHttpFileDownload::Do()><o p=""></o>

11/26 17:49:49 [3396] <LUDownloader::GetContentToFile> completed. <o p=""></o>

11/26 17:49:49 [3396] <CHttpFileDownload::~CHttpFileDownload()><o p=""></o>

11/26 17:49:49 [3396] </CHttpFileDownload::~CHttpFileDownload()><o p=""></o>

11/26 17:49:49 [3396] <LUThreadProc>@@@@@@@@@ LU DEBUG ONLY- Download file failed due to wrong file size. <o p=""></o>

 FileName:C:\Program Files\Symantec\Symantec Endpoint Protection\LiveUpdate\LUF{C60DC234-65F9-4674-94AE-62158EFCA433}91125048911250327.TMP Expected file size: 113149<o p=""></o>

11/26 17:49:49 [3396] <SetupTempLUFilePath:>NEW download: C:\Program Files\Symantec\Symantec Endpoint Protection\LiveUpdate\LUF{C60DC234-65F9-4674-94AE-62158EFCA433}91125048911250327.TMP<o p=""></o>

Regards,
Christoph

[Migration User]

how many gup pc having the problem?
Refer below doc also
Troubleshooting the Group Update Provider (GUP) in Symantec Endpoint Protection 

[Migration User]

If it the problem only for one gup try by assigning another pc in the same group as gup and see... 

[Migration User]

All 3 GUPs have the same issue.
2 of them were w2k3 and one w2k8, all were virtual. I am now checking the document. hold on....

[Migration User]

I have seen this issue with RU5 GUP on 2 ocasssion. Will post if there is  an update on the same

[Migration User]

WOW we found a solution!

We use two SEP-M and both were listed in the serverlist with the same priority.  If a client is connected to SEPM1 and the GUP with SEPM2 the client is not able to veryfy the provided delta. Seems to be a bug!

So if someone has the same issue, delete one entry in the serverlist.

Regards,
Christoph