Protection Engine server fails to update virus signature versions due to failure to connect to the Live Update server

Products

• Protection Engine for Cloud Services

Issue/Introduction

After installing a new SPE 9 server it was observed that the antivirus signature date stamp remained at the earliest version (October 2021).

An examination of the lux.log file showed the following series of events (repeated)

 

16:15:41.204342 [Server Selection - START]
16:15:41.219968     Result Code: 0x80010830
16:15:41.219968     Result Message: FAIL - failed to select server
16:15:41.219968     [Server - START]
16:15:41.219968         Host ID: {113395A0-D3D8-4BE4-80B5-202C94EF4A75}
16:15:41.219968         Status Code: 1
16:15:41.235658         Status Message: Server was not selected
16:15:41.235658         Transport Return Code: 0x80010731
16:15:41.235658         Transport Return Message: FAIL - download failed
16:15:41.235658         Protocol: HTTP
16:15:41.235658         Hostname: liveupdate.symantec.com
16:15:41.235658         Port: 80
16:15:41.235658         Path: 
16:15:41.236168         Proxy ID: {00000000-0000-0000-0000-000000000000}
16:15:41.236168         Proxy Bypass: false
16:15:41.236168     [Server - END]

An attempt was made to access the liveupdate server directly by opening a web browser on the SPE server and trying to hit the site (per KB224023) was successful.

Environment

Release : 9.0.0

Cause

A local or network setting in the environment did not allow for non secure communications going out to the internet from the servers. It was not clear why the web browser was able to do so although it is probably that it had proxy setting that facilitated a successful transaction.

Resolution

Changing the access method from http:80 to https:443 resolved the problem.

Option 1:

Select the server via the SPE 9 application console.

Navigate to "Settings > LiveUpdate Settings" and change the method from http port 80 to https port 443

 

Option 2:

- Open an administrative command prompt.

- CD into the "Scan Engine" folder :  C:\Program Files\Symantec\Scan Engine

- Run the following commands:

XMLModifier.exe -s //liveupdate/UpdateServer/Protocol/@value https liveupdate.xml

XMLModifier.exe -s //liveupdate/UpdateServer/Port/@value 443 liveupdate.xml

- Restart the Symantec Protection Engine Service.