SSC reporting missing defs

[9amwhiskey]

Hello all

I've recently updated to version 10.0.2 on everything, and now I am getting a handful of clients that report that they are missing their defs....when you manually push a def update from the ssc, their status remains the same, but in the AV event log, and windows App log, they report that their defs are up to date....anyone know why ssc isn't reporting the right information?

 

[paulhthomas]

It may be that the defs haven't updated properly. we've written an automated script that goes and checks defs of a list of server everyday. accordingly to the av itself the defs are upto date, but our script says different. i think it's down multiple registry keys that are updated to list the def version, if the update fails part way through (disk fills for example); some of these keys report a later def than others.
Try doing a def roll back or reinstalling the software and it should sort the issue. It may also be worth running the Intelligent Updater exe of the symantec site.
Cheers

Paul

 

[9amwhiskey]

thanks for the response. the thing is, its different clients every day. for example, yesterday there was a list of about 7 clients reporting missing defs, today, a different set of 11 clients...sometimes there are repeat offenders, sometimes not. was is consistant is that on each machine, both symantec and system logs indicate correct def loads...its starting to bug me now.

 

[paulhthomas]

hmmm, so when you say missing defs, what do you mean? does the place for the def date appear blank for example?
How does it look in the System Centre Console?

 

[9amwhiskey]

yea, in the console, the status indicates that there are missing defs, and under the defs, its blank....but the scans are going, and the logs look good....i dunno man, its very odd

 

[paulhthomas]

Apparently......

This problem can happen for the following reasons:

You installed Symantec AntiVirus without virus definitions.
The virus definitions on the affected computer are not complete.
The installation of Symantec AntiVirus is corrupted.

Because this problem has more than one cause, more than one solution is provided. To fix the problem, try each of the following solutions in the order that they appear.

Run LiveUpdate
Start Symantec AntiVirus on the affected computer, and then run LiveUpdate.

Restart the Symantec AntiVirus service,
Stop and then start the Symantec AntiVirus service on the affected computer.

Manually update virus definitions
Manually update the virus definitions on the affected computer.
You can do this by either copying an xdb file into the program files/sav folder OR run the Intelligent Updater

Remove Symantec AntiVirus
Uninstall Symantec AntiVirus and restart the computer. Then, install Symantec AntiVirus again. If Symantec AntiVirus is corrupted, you may be unable to remove Symantec AntiVirus completely by using Add/Remove Programs. If the problem persists, manually remove Symantec AntiVirus.

Let me know how you get on

 

[9amwhiskey]

i think at this point i am going to chalk it up to people shutting their PC off during the virus update.....there's just no trend to it right now to commit to a solution. thanks for the time and suggestions with this

cheers

 

[paulhthomas]

no worries. if you do ever find a "solution", post it here.