The customer needs to verify where the Symantec Endpoint Protection (SEP) clients are getting LiveUpdate (LU) content from without accessing the client.

The most common method is to view the client activity from the Symantec Endpoint Protection Manager (SEPM).

Clients are updating, but the update source is not clear.

Access SEP client LiveUpdate activity from the SEPM:

• Navigate to Monitors > Logs in the SEPM console.

• Choose "System" from Log Type drop down menu.

• Choose "Client Activity" from Log Content drop down menu.

• Choose Default filter and appropriate time range.

• Click on Advanced Settings.

• In the Event Source field, enter "sylink" (with no quotations) after the asterisk.

• The remaining fields can be left at default or adjusted as appropriate.

• Click on View Log (this filter can also be saved).

• Client Live Update activity will be shown, including downloads with the download source listed.

Applies To

Symantec Endpoint Protection 12.1