Endpoint Protection Linux LiveUpdate fails due to RAM or disk space allocation errors

Products

• Endpoint Protection

Issue/Introduction

When running Symantec Endpoint Protection (SEP) Linux LiveUpdate from client GUI, error "LiveUpdate failed" is displayed. When running LiveUpdate from command line the percentage progress for definitions processing stops before 100% and error is displayed "Command failed: Failure in post processing of micro definitions during update". In both instances, the initial download appears to complete OK (Return Code = 0 in liveupdt.log) and the failure is in post processing.

The RAM or disk space allocation errors are not always obvious.

Enable LiveUpdate defutil logging then gather Linux trace logging with the following command line:
sudo strace -f -o lutrace.log /opt/Symantec/symantec_antivirus/sav liveupdate -u

Be advised, the logging generated by strace can grow to be quite large (gigabytes in size) but should compress nicely, being plaintext.

Search lutrace.log for instances of "ENOMEM (Cannot allocate memory)" or "ENOSPC (volume/disk out of space)"

Cause

This may be caused by low RAM or disk space. The requirements for definition downloads and processing can be substantial. There have been some reports of LiveUpdate failing with ENOMEM error in strace logging, despite sufficient free RAM -- this can be caused by incomplete distributions of content at a LUA server (LiveUpdate Administrator) server: check your LUA configuration.

Resolution

Please reference "Disk Space" in Overview of Symantec Endpoint Protection Linux requirements and ensure that sufficient disk space is available in /opt/ and /tmp/.

The SEP Linux minimum RAM requirement is 1GB but this may need to be increased if there are other processes competing for that space.

Try running the Linux Intelligent Updater to update/repair definitions---this may resolve some instances of ENOMEM:
How to update a Linux-based computer with Intelligent Updater definitions

If disk and RAM space are sufficient and lutrace.log above confirms no memory of disk space allocation errors, then continue troubleshooting with defutil logging.