Hi dear members of the forum
We've encountered an issue which I'm currently working with tech support on ; since upgrading our SEPM to 12.4 RU4 MP1 we've had massive spikes on our WAN data links; some remote sites are running at 100% network utilisation where as they usually operate at 20-40%. If i shut down the apacahe web server service on the SEPM, these network spikes go down and the site runs normally. Its so bad the remote sites are unable to operate as their WAN link is completely saturated.
While working on this problem, I have a question about how clients get updates when you use GUP's:
My understanding is that when you have a GUP configured at a remote site, the client will perform heartbeat communications with the SEPM but get content and policy from the GUP. Is this correct ?
Take this scenario:
SEPM: location UK
Client with GUP : location Czech Republic (GUP server name: SECZESSSLUT001)
Here is a sample of the client log: (SEPM server name : SEUKESSSCRA001)
Remote file path: http://SECZESSSLUT001:2967/content/{810D5A61-809F-49c2-BD75-177F0647D2BA}/140711017/xdelta140710008.dax SYLINK
00000106 01cf9f293fcb1e9d 1207030c 00000000 00000002 00000000 Downloaded new content update from Group Update Provider failed.
ile path: http://SECZESSSLUT001:2967/content/{810D5A61-809F-49c2-BD75-177F0647D2BA}/140711017/xdelta140710008.dax SYLINK
00000106 01cf9f2a590ff465 1207030c 00000000 00000002 00000000 Downloaded new content update from Group Update Provider failed.
Remote file path: http://SECZESSSLUT001:2967/content/{810D5A61-809F-49c2-BD75-177F0647D2BA}/140711017/xdelta140710008.dax SYLINK
0000008c 01cf9f2ab74813c0 12130002 00000002 00000001 00000000 [File reputation submission] Submitting information to Symantec failed. REP
00000106 01cf9f2b72893eb9 1207030c 00000000 00000002 00000000 Downloaded new content update from Group Update Provider failed.
Remote file path: http://SECZESSSLUT001:2967/content/{810D5A61-809F-49c2-BD75-177F0647D2BA}/140711017/xdelta140710008.dax SYLINK
00000081 01cf9f2d6fa56a5c 120b0007 00000000 00000000 00000000 Failed to connect to all GUPs, now trying to connect SEPM SYLINK
000000cb 01cf9f2d701038be 12070800 00000002 00000000 00000000 An update for {810D5A61-809F-49c2-BD75-177F0647D2BA} was successfully installed. The new sequence number is 140711017. LiveUpdate Manager
0000010c 01cf9f2d701038be 1207030c 00000000 00000000 00000000 Downloaded new content update from the management server successfully.
Remote file path: http://SEUKESSSCRA001:8014/content/{810D5A61-809F-49c2-BD75-177F0647D2BA}/140711017/xdelta140710008.dax SYLINK
000000cb 01cf9f2d89a1ea34 12070800 00000002 00000000 00000000 An update for {07B590B3-9282-482f-BBAA-6D515D385869} was successfully installed. The new sequence number is 140711018. LiveUpdate Manager
0000010c 01cf9f2d89a1ea34 1207030c 00000000 00000000 00000000 Downloaded new content update from the management server successfully.
Remote file path: http://SEUKESSSCRA001:8014/content/{07B590B3-9282-482f-BBAA-6D515D385869}/140711018/xdelta140710024.dax SYLINK
000000cb 01cf9f2d8c5fc8b8 12070800 00000002 00000000 00000000 An update for {55DE35DC-862A-44c9-8A2B-3EF451665D0A} was successfully installed. The new sequence number is 140711011. LiveUpdate Manager
0000010c 01cf9f2d8c5fc8b8 1207030c 00000000 00000000 00000000 Downloaded new content update from the management server successfully.
You can see the client is communicating with the GUP (SECZESSSLUT001) but the download failed for whatever reason.
Can someone tell me why the client talks to SEUKESSSCRA001. Is this because it was unable to get the required updates from the GUP ?
Thanks