SEP client intermittently failing to download definitions with Server selection failed message

Products

• Endpoint Security

Issue/Introduction

Symantec Endpoint Protection clients fail to download virus definitions either consistently or intermittently.  One or more of the following error messages exist in the client's LiveUpdate log named log.lue.

* REQUEST_ERROR - error 12152 (0x00002F78), result API_RECEIVE_RESPONSE. File: minitri.flg
  Server selection failed for server HTTPS://liveupdate.symantecliveupdate.com/ on port 443.
* Download Error for minitri.flg. SERVER DOES NOT EXIST or some network issue.
* Invalid response from the server while downloading minitri.flg. INVALID SERVER RESPONSE.
* Server selection failure; will now attempt to select server via explicit name resolution.
* DnsQuery() for (liveupdate.symantecliveupdate.com) with DNS server (XXX.XXX.XXX.XXX), failed; err = 1460
* DnsQuery() for (liveupdate.symantecliveupdate.com) with DNS server (XXX.XXX.XXX.XXX), failed; err = 1460
* Reporting error: 0x8D048026 DnsQuery failed liveupdate.symantecliveupdate.com, 1460
* LiveUpdate Server Selection has finally failed after explicit DNS resolution.
* Error downloading files. Error Code: 0x8D048029

 

Environment

• Symantec Endpoint Protection 14.3.x

Cause

Timeout when attempting DNS resolution.  This could have several root causes such as:

• DNS server is down or overloaded.
• Internal Network error.
• Firewall or Network appliance blocking traffic or causing slowness.

Resolution

The DNS error code

err = 1460

is returned when a lookup failure occurs.  It means there was a timeout error.  DNS queries may be slow or blocked.  This is not an issue with the Symantec Endpoint Protection agent itself, rather it's caused by network congestion or DNS lookup failures.