Symantec Endpoint Protection client fails to apply content updates received from Symantec Endpoint Protection Manager

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection (SEP) fails to apply content updates received from a Symantec Endpoint Protection Manager (SEPM) with ProcessLUDownloadedFile error 18 in the sylink log.

The SEP sylink.log contains the following error.

[Content]<ProcessLUDownloadedFile>SMC failed to process the content update: Error: 18

In some cases it will contain the following error, with varying monikers.

[Content]<LUThreadProc----> Content update not ready for download: Moniker: {535CB6A4-441F-4e8a-A897-804CD859100E} Target Seq: 151026022 State: 3
 

The SEP debug.log may contain the following error, with varying monikers. (The version number will match the installed version.)

SyLinkEventFunc - EVENT_LU_DOWNLOAD_COMPLETED: Failed to move package from C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\LiveUpdate\LUF{535CB6A4-441F-4e8a-A897-804CD859100E}1510260221.TMP to C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\SmcLu\content.zip

Cause

This error is encountered when a file copy operation fails during the routine for processing content updates.

Resolution

To resolve this error identify the root cause for the file copy operation failing. A file copy operation can fail for a number of reasons, including the following:

• Access Control List (ACL) prevents SMC.exe from performing the file copy operation.
• SMC.exe is attempting to copy the file to an invalid destination path.
• Insufficient disk space.

The example conditions can be identified using Process Monitor. An ACL issue will often show a result of ACCESS DENIED. An invalid path will often show as PATH NOT FOUND.