Symantec Scan Engine 5.2 is sending alert notifications stating "There was an error running content update, scanning will continue using the original definitions"

Products

• Scan Engine

Issue/Introduction

You have received an alert from Symantec Scan Engine 5.2 stating "There was an error running content update, scanning will continue using the original definitions Date/time of event = Scan Engine Port number = Uptime (in seconds) = ," however all definition sets report as being completely up to date in the Scan Engine control center.

Symptoms
Receiving alert: "There was an error running content update, scanning will continue using the original definitions Date/time of event = <date and time)  Event Severity Level = Error Definitions = Virus definitions Update Method = LiveUpdate Scan Engine IP address = <IP of scan engine server> Scan Engine Port number = <port number> Uptime (in seconds) = <uptime>," 

Scan Engine definitions are fully up to date.

The date and time of the alert is prior to the current definition set.

Conditions

The Scan Engine server also has Symantec Antivirus Corporate Edition or Symantec Endpoint Protection.
The local auto-protect client is stand-alone and retrieves definitions via Liveupdate and not a parent server.

Application Log Entry Shows:

Source: Automatic LiveUpdate S
Event ID: 101
Description:
Information Level: success
Description:
Rolling back the schedule; execution will occur at approximately 11:19 AM

Examination of Liveupdate Applet in the Windows Control Panel shows that Automatic Liveupdate is scheduled.
 

There was an error running content update, scanning will continue using the original definitions Date/time of event = <date and time)  Event Severity Level = Error Definitions = Virus definitions Update Method = LiveUpdate Scan Engine IP address = <IP of scan engine server> Scan Engine Port number = <port number> Uptime (in seconds) = <uptime>

Cause

The most probable cause of this particular symptom is that another instance of Liveupdate is running at the time the Java Liveupdate program which updates scan engine runs. Because they both use the same connection methods and ports, there will be a port conflict and one of the connections will fail.

Resolution

Examine the settings between the two Liveupdate programs and ensure that they are not configured to retrieve definitions at or around the same time. A recommended time different of at least thirty minutes is preferential. If you determine that the Liveupdate programs are not set to run within a half hour each other, please contact Symantec Technical Support for assistance with this symptom.