Endpoint Protection Manager intermittently fails to install downloaded LiveUpdate content

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection Manager (SEPM) sometimes logs errors installing LiveUpdate content. The Windows Event Viewer may contain log entries such as:

"Info:Content download to the server failed. Symantec Endpoint Protection Manager could not update.."

Subsequent LiveUpdate sessions update the failed content without any problems.

The LiveUpdate.log has entries similar to the following:
When the error occurs:

Available Update for Product: SEPM Iron Revocation List 14.0, Version: MicroDefsB.CurDefs, Language: SymAllLanguages, ItemSeqName: CurDefs.  Current Sequence Number: 161215018, New Sequence Number 161215022, Update filename 1481851888jtun_irev161215018.7z

Progress Update: DOWNLOAD_FILE_START: URL: "1481851888jtun_irev161215018.7z", Estimated Size: 422385, Destination Folder: "C:\ProgramData\Symantec\LiveUpdate\Downloads"
HttpSendRequest (status 404): Request failed - File does not exist on the server.

When a subsequent LiveUpdate runs and succesfully downloads and installs the specific content:

Available Update for Product: SEPM Iron Revocation List 14.0, Version: MicroDefsB.CurDefs, Language: SymAllLanguages, ItemSeqName: CurDefs.  Current Sequence Number: 161215018, New Sequence Number 161215025, Update filename 1481867026jtun_irev161215018.7z

Progress Update: PATCH_FINISH: Patch File: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt426\1481867026jtun_irev161215018.7z", Script File: "C:\ProgramData\Symantec\LiveUpdate\Downloads\Updt426\IrvSepLi.dis", HR: 0x0       

 EVENT - PRODUCT UPDATE SUCCEEDED EVENT - Update available for SEPM Iron Revocation List 14.0 - MicroDefsB.CurDefs - SymAllLanguages. Update for CurDefs takes product from update 161215018 to 161215025. Server name - liveupdate.symantecliveupdate.com, Update file - 1481867026jtun_irev161215018.7z, Signer - cn=Symantec Corporation,ou=Locality - Tucson - P01,ou=Product Group - LiveUpdate,ou=SymSignature 2005,o=Symantec Corporation, package install code 0. The Update executed with a result code of 1800, => Success
 

Resolution

The issue can occur when an update to the specific content is available while the LiveUpdate session is still in progress. Under some circumstances the file that LiveUpdate is trying to download may have been replaced on the LiveUpdate servers making the initial file unavailable for download.
The LiveUpdate.log file entries above record this situation:

When the error occurs:
"New Sequence Number 161215022 ... 1481851888jtun_irev161215018.7z - Request failed - File does not exist on the server"

When a new update is available just a few hours later:
"New Sequence Number 161215025 ... 1481867026jtun_irev161215018.7z - The Update executed with a result code of 1800, => Success"

The key to understanding this is in the filenames. 1481851888 and 1481867026 are formatted as Unix timetamp dates indicating when the files were created.
1481851888 = Fri, 16 Dec 2016 01:31:28 GMT
1481867026 = Fri, 16 Dec 2016 05:43:46 GMT

When the updated content is available for download, LiveUpdate will download and install it the next time it runs.