HTTP 403 Errors Logged in LiveUpdate Administrator During Content Download

Products

• Endpoint Protection

Issue/Introduction

While reviewing lua-application.log (or rotated lua-application-N.log) files, administrators may notice a large number of ERROR entries similar to:
ERROR rcl.HttpHelper [] - Http Error Msg : HTTP/1.1 403 Forbidden
ERROR rcl.HttpHelper [] - Fatal transport error in download: java.io.FileNotFoundException: 403: could not find file to download - http://liveupdate.symantecliveupdate.com/...microdefsb.<variant>_symalllanguages_livetri.zip
These entries are typically numerous and coincide with a scheduled LiveUpdate Administrator content Download job.

Environment

 LiveUpdate Administrator (LUA), all supported versions

Cause

During each scheduled Download, LiveUpdate Administrator checks, for every configured product/component/revision, whether an incremental definition file exists for various combinations. This is expected design behavior: not every variant combination exists for every product at every point in time. LUA is designed to probe each possibility and simply move on when a given candidate file isn't present — this does not indicate a problem with your installation.
When a probed file genuinely does not exist, the LiveUpdate content server normally returns an HTTP 404 (Not Found), which LUA logs and treats purely as "this optional file is not applicable" — no administrator action is needed, and it has no effect on the content that does exist and downloads successfully.
In certain network environments, this same "file not present" condition can be reported as an HTTP 403 (Forbidden) instead of the expected 404. For LiveUpdate Administrator's purposes, these two responses are handled identically: in both cases LUA concludes the specific candidate file is unavailable for that revision and proceeds to the next candidate in the cycle.
Impact

• This behavior affects only the internal candidate-file probing mechanism (filenames ending in _livetri.zip) — it does not apply to actual product content/definition packages.
• Products and components for which valid content exists continue to synchronize and distribute normally.
• These log entries, while logged at ERROR severity for diagnostic completeness, do not by themselves indicate a Download failure.

Resolution

Recommended Action

• No action is required if the LUA console shows your products/components as current and distribution status as successful.
• If you separately observe stale or missing content for specific products, or distribution failures in the console, please contact Broadcom Support with the affected time window and relevant log excerpts — that would represent a distinct issue from the one described here.