LiveUpdate Administrator is unable to download the latest definitions for Symantec Protection Engine

Products

• Protection Engine for NAS

Issue/Introduction

After July 18th, 2021, LiveUpdate administrator is reporting virus definitions are corrupt when downloading the package to update Symantec Protection Engine (SPE)

In the lua-application.log, located in C:\Program Files (x86)\Symantec\LiveUpdate Administrator\logs, the following sequence of events is observed:

ERROR download.ValidateDownloadHelper  - file in update package is too big : 734003200
ERROR download.ValidateDownloadHelper  - Package size exceeded max size limit - 1626701980jtun_symdeeplist1.x86
threadpool.LUAThreadPool  - Execute: LUA THREAD POOL SIZE: 1 total task count: 1 Active task count: 1
download.LuaSegmentedThreadPool  - Execute: LUA SEGMENTED THREAD POOL SIZE: 0 total task count: 1 Active task count: 1
ERROR handler.RequestHandler  - Found failed status for file thread: thread result: CORRUPT payload state: CREATED
ERROR handler.RequestHandler  - java.lang.Exception: Download of update not completed
handler.RequestHandler  - Updating status of downloadJob : 6 to ---> JOB_FAILURE
handler.RequestHandler  - ************LUA_DOWNLOAD_CONTENT TRANSFER_END************
download.DownloadUpdateRequest  - Download Request Invocation Result : FAILURE

Environment

ensure 

Cause

The package for Symantec URL Reputation services has exceeded the maximum size allowed by LiveUpdate administrator.

Resolution

Table of Contents

• Update 7/22/21
• Workaround

Update 7/22/21

The package size has been reduced to avoid this behavior, no customer action is required at this time.

Workaround

Most SPE deployments do not require the DeepSiteURL definition updates. If the SPE clients are not using the URL reputation feature, the LUA server can be configured to provide only the Virus definition updates, which will work around this issue.

To enable downloads for only the virus definition updates:

1. Open the LiveUpdate Administrator console
2. Select Download & Distribute.
3. Click Add Distribution.
   
4. Give the new distribution schedule a unique name, such as "SPE definitions distribution"
5. Next to the "Product" list, select Add
   
   
6. Click the + icon next to "Symantec Protection Engine 8.0 English", or any other SPE definition versions required
   
7. Select the check box next to "Content Updates", ensure that the "Client Updates" check mark is left unchecked.
   
8. Click Add.
9. In the resulting "Edit Distribution Schedule" page, select the schedule as "After Download Schedule"
   
10. Click OK.
11. Click Add Download.
    
12. Give the new download schedule a unique name, such as "SPE definitions download"
13. Next to "Select Products" click Add
    
14. Click the + icon next to "Symantec Protection Engine 8.0 English", or any other product versions needed.
15. Select the check box next to "Content Updates", ensure that the "Client Updates" check mark is left unchecked.
    
16. Click Add.
    
17. In the resulting "Edit Download Schedule" page, select the schedule as desired, for this example every 4 hours.
    
18. Select the checkmark next to Run selected Distribution Schedules automatically after this download completes.
    
19. Add the "SPE definitions distribution" to the right pane 
    
20. Click OK.

To avoid errors with the previously existing download schedule, remove the existing schedule by selecting the checkmark next to the download and distribution schedules, and click Delete.

If URL reputation services are required, Symantec support recommends performing the above steps, and in addition upgrading to the 8.2.1 release of SPE. The DeepSite engine is replaced by the WebPulse engine, which no longer requires content updates via LiveUpdate.