SEPM LiveUpdate is not functioning after the server's clock was accidentally moved into the future

book

Article ID: 156005

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

After the Symantec Endpoint Protection Manager (SEPM) server's time clock was advanced inadvertently into the future, automatic LiveUpdate will not run.  The mini server event log in the console does not show the correct and most current information.

Log time stamps are incorrect and in the future after fixing the SEPM's time date issue.

Cause

  • The date on the SEPM machine was set one year into the future
  • While the date was wrong LiveUpdate had finished and entered log data with the future time/date stamp
  • All events going forward are logged with the future date and cause it to not run

Resolution

This is expected behavior based on the design.  When events are completed they are logged with the time stamp when they happened and are inserted into the database.  Subsequent scheduled or timed events such as LiveUpdate use those entries to base the future scheduling on.  Events inserted with a future date can skew or prevent them from running as expected.  To resolve this issue, there is a tool included in the SEPM tools directory.  Please follow the instructions below.

  1. Locate the SEPM tools directory (...\Symantec Endpoint Protection Manager\Tools\)
  2. Stop the SEPM service
  3. Run the tool updatedbtime.bat
  4. Start the SEPM service

Applies To

  • SEPM time date stamp was moved into the future and fixed
  • After resolving the time/date issue, event going forward are still logged in the future
  • Automatic LiveUpdates are not working correctly