How to update a Linux-based computer with Intelligent Updater definitions
search cancel

How to update a Linux-based computer with Intelligent Updater definitions


Article ID: 177981


Updated On:


Endpoint Protection


You want to know how to obtain and install standalone virus definitions on your Linux-based operating system (RedHat, Ubuntu, etc.), using Intelligent Updater (IU) definitions.


1. Obtain (download and save) the Intelligent Updater from one of the following locations:

For SEP client version 14.3 RU1 and later:
Look for a filename ending in (for example, sef/
Look for a filename ending in (for example, sef/

For SEP client version 14.3 MP1 and earlier:
On the "Linux / *nix" tab, look for a filename ending in (for example,

Look for a filename ending in (for example,

c. is a statically named file that is updated with each daily release of definitions.

Note: Definition hosting has moved from FTP to HTTP-foldered servers. FTP is fully discontinued since Dec 21, 2019

Note: The file download via HTTP is typically faster than FTP. The current size of the file is just under 400 MB.

Note: Once downloaded, the .SH file needs to have executable permissions. To accomplish this, execute the following command:

chmod +x *


2. The script must be executed as root or by using sudo; if it is not, the following error will occur.

  • $ ./
    Validating available tools...
    ERROR: Require write access to /opt/Symantec/virusdefs/incoming.
    There are several methods to meet this requirement.
    1. Run this script from the root user account.
    2. Add the current user as a member of the "avdefs" user group.
    3. chmod 777 for /opt/Symantec/virusdefs/incoming.
    We recommend either of the first two options for security reasons.

3. Uudecode and uncompress must be installed. These can usually be installed by installing the Sharutils package. In some instances, you may need to install the ncompress package as well.

Note: If you get an error referencing either utility, please run one of these commands as root or by using sudo to install them. The command to install sharutils may be different than those listed below, depending on the distribution and version of Linux being used.

  • up2date sharutils
    yum install sharutils
    apt-get install sharutils
  • up2date ncompress
    yum install ncompress
    apt-get install  ncompress


4. A successful definition installation via Intelligent Updater should result in the following output.

  • # ./
    Validating available tools...
    Extracting Intelligent Updater software package...
    Checking software package for damage...
    Uncompressing software package...
    Extracting distribution files...
    Installing virus definitions to /opt/Symantec/virusdefs/incoming
    Copying definition files...
    Removing temporary files.
    Virus definitions installed successfully.
    A transcript of this installation has been saved as /var/log/iu-install.log

Note : For SEP client version 14.3 RU1 and later, installing virus definitions to location " /opt/Symantec/sdcssagent/AMD/sef/definitions/symcdata/symplatformdefs/incoming"


Additional Information

Note that the updater (32-bit) provides the appropriate updates for both 32-bit and 64-bit SEP for Linux (SEPFL) clients. Even with 64-bit Linux systems, use the file that ends with "" not ""


Additionally, if you run the Live updater tool, you may be prompted to Gather Extended repositories.

**This is a 30gb repository**

In Red Hat Enterprise Linux 6 & 7, sharutils package is available through the "Server Optional" channel:  

In RHEL8, sharutils is in the "CodeReady Linux Builder" repository:

**This requires your Red Hat Enterprise Credentials**


Additional information on methods of keeping Symantec Endpoint Protection for Linux clients up-to-date can be found in the Connect article SAV for Linux: A (Somewhat) Illustrated Guide Part 3