Alex Scoble's IT Notes - An Information Technology Blog

Upgrading Symantec Corporate Edition Antivirus Servers

Let me just start out by saying "Do not, I repeat, do not upgrade a Symantec CE AV Server with version 9.01". That is the latest public version visible on the website, but it has a bug that may cause the server to create a duplicate server group. So if you have a server group named SYMCE, you will see a duplicate group named SYMCE (2).

If you have a current subscription (which you better have if you are using Sym CE AV anyhow) call up their support and get the location and passwords to download 9.0.2.

And it's best if you uninstall everything from the server (AMS, SSC, AV, LiveUpdate) and then reinstall from the new version. Of course if you do that and don't have a backup server, you will lose all of your configuration settings, so make sure you have a backup server before you uninstall from one of your Sym CE AV servers.

Live Update Issues On Symantec Corp AV

This has been an issue that I thought was resolved but started happening again.

We run Symantec Antivirus Corp Edition 9.x here. I have 4 servers, 2 of which are legacy and haven't had managed clients moved off of them. The main server for the organization has not been getting updates from LiveUpdate properly.

The error that showed up regularly in the Event log was "Download of virus definition file from LiveUpdate server failed. 00000001". Try searching for this in Symantec's knowledge base and you will come up empty.

So, I did some digging on their site for just general LiveUpdate issues and found that the next thing to try is to manually run LiveUpdate from the AV client. Did this and kept getting the error "LU1814 error: LiveUpdate could not retrieve the catalog file of available Symantec product and component updates." Looked up this error and there were troubleshooting steps that you could follow.

At this point, I should also mention that originally this server had the LiveUpdate Administrator installed. Read another Symantec article that said that LiveUpdate Administrator was only needed for certain large deployments of Symantec CE and should not be used unless it's needed. So it was removed.

OK, so step one is to make sure you are running latest version of LiveUpdate. Did that. No effect.

Step two was to make sure you can connect to the internet. Oh wait, at this point I read that Corp users should go to the bottom of the page for troubleshooting tips. :)

OK so step two was to check the hosts file on the system. Did that and it was just the default hosts file. No joy with that one.

Step three was to delete the Settings.LiveUpdate files from (this is the default path) c:\documents and settings\all users\application data\symantec\liveupdate\. If you go there, you will see the Settings.LiveUpdate file, the 1.Settings.LiveUpdate, etc. After banging my head against a thick wall for a while going through these steps, doing more research, deleting LiveUpdate Administrator, doing more research and then going through these steps again LiveUpdate started working! Hallelujah!

But wait! Of course there's more to it, or I wouldn't be writing this.

So the problem started up again within the last week (just noticed it yesterday, yeah so I don't look to see if the virus defs get updated every day, shoot me :p). So I start looking at the contents of the Log.LiveUpdate file on that server and on other client/servers that work. I notice that the server is attempting to go to a null address as in FTP://. So I notice that in the Settings.LiveUpdate files on that server that subnet and subnet mask are set to 0. On the other servers/clients it's set to 0.0.0.0.

I change subnet and subnet mask on all the Settings.LiveUpdate files on the server and voila! It works again.

Now I just have to keep monitoring that server to make sure that it updates properly.

This has been another obscure fix brought to you by yours truly. Have a safe and fun Halloween.

Unexplained Errors

I just love it when you get one of those "The Service terminated unexpectedly" errors in the event log on Windows server.

Had that happen Saturday morning in the whee hours to the BackupExec Agent on my backend Exchange server, so nothing on that server was backed up Saturday or Sunday night and the mailboxes were missed on Friday.

Hope it doesn't happen again tonight, or I will be scratching my head trying to figure out wtf is going on.

All your documents on the web

One of the things I'm trying to push through is allowing members of the firm the ability to access firm data anytime, anywhere from just about any computer.

Well, today I got a step further in that quest. It's not fully deployed yet, but I have set up and tested WORLDOX/Web. Which is the web serviced component to our Document Management System. Pretty cool stuff too!

So now attorneys can check out documents, work on them and check them back in, from anywhere on the web, as long as they have access to the proper application (Word, Excel, WordPerfect, etc.) that the document was originally saved in. Generates the proper document numbers for new documents and is pretty easy to use.

One proviso that I would add, if you do purchase the software from World Software, follow the instructions as best as you can and when the installation doesn't work (it won't work because the documentation isn't all that great), call tech support.

BTW, if you are wondering how I could just have all of our documents hanging out on our web for everyone to grab, they aren't. There's security built into the WORLDOX/Web application and I have the web site itself protected by SSL encryption.

Not as good as VPN security, no, but I'm enforcing strong password protection and perhaps one day we will budget for some sort of smart card authentication system.

If anyone knows anything about that, I'd be glad to hear it.

Full SQL License? We don't need no stinking full SQL license!

One of the problems of being a larger small company (greater than 25 but less than 50) is that most software isn't priced for us. Take SQL server for instance. At a cost of about $7000 per CPU for an unlimited user license (which you need if you have more than 25 users), it is very expensive.

Sure we could buy the Small Biz Server package, but that has some big limitations. It isn't very flexible everything has to be run on one server oh and last time I checked, you were locked into it.

No way to move users and their Exchange data, for instance, off of a SBS server and onto a standard licensed server. Perhaps they changed this after SBS NT, but that was the last time I used it and so am not quite sure. Never have liked the limitations that you had to live with in that product anyhow. Makes sense for a business smaller than 25 people, but NOT if they ever expect to grow larger (startup anyone?).

At any rate, we now have some products that require the use of a SQL server or at least the MSDE runtime of it. We don't currently want to shell out $7000 for the license and $6-7000 for the hardware to run it (server with 2 drives for the OS and 6 for the data).

So we are using the MSDE runtime (OK, this isn't exactly doing it right, but it saves us $14000 in the short run and we probably don't need the full blown license at this point). The MSDE runtime is basically a neutered SQL engine that doesn't come with any of the cool GUI tools, has some limitations on number of databases and isn't as scalable as SQL Server.

It wasn't exactly easy to work with at first. This was my first foray into SQL Serverland and so I had to start from scratch on the Microsoft websites (ain't MSDN grand?). Quickly learned that the command line interface for SQL kind of sucks. So I kept poking around on MS's websites and lo and behold! I found that they offered a web based GUI version of their Enterprise Manager tool.

It's called the MS SQL Web Data Administrator and it gives you most of the functionality of the GUI tool that comes with SQL server and best of all it even works with MSDE! You can either find it on Microsoft's website by searching for "SQL web data administrator" or go to this link: http://www.microsoft.com/downloads/details.aspx?FamilyID=C039A798-C57A-419E-ACBC-2A332CB7F959&displaylang=en.

Some people will probably think of me as a lazy admin for not trying to set the server up with the CLI tools, but sorry, I work much better in a GUI and the proof is in the pudding. Messed with the server for hours trying to get things working with the CLI. Took me around 30 minutes to figure out what was what in the web data GUI.

I'll take a well made GUI any day over a well made CLI. Although most CLIs aren't well made - not intuitive at all and very little documentation. Whereas GUIs are better since they display much more of the interface and since it's visual, you typically don't need much documentation.

So my first dealings with SQL weren't too bad, I suppose. Once I got the right tool that is.

BTW the two pieces of software that we need SQL for are CompuLaw's Vision SQL calendaring software and KI Systems Word Template Package that also includes a contact manager set up specifically for law firms.

Microsoft Support Incident

Well, say what you will about Microsoft, but I am currently dealing with them on an issue and have found their support to be prompt, courteous and helpful.

Here's the scenario...User running Office 2003 on a Dell Latitude D800 with Windows XP Pro. Outlook 2003 is crashing often. 20 times today according to the user.

User has a rule to move any emails larger than 256kb to the large messages folder. This is a server side rule.

User is connecting to Exchange Server 5.5 SP4 running on an NT 4.0 SP6a box with Norton AV for Exchange.

Looked on Microsoft's website and found article 834466 that lists symptoms very similar to that above.

Basically, the problem might be caused when the server isn't properly converting messages with ASCII text to Unicode.

Anyhow, called up Microsoft support to get the hotfix (ok so it's a little annoying that they make you call for the fix, but I guess they want to make sure that you need it), get an answer right away and 10 minutes later I have the fix. Looks like they have plenty of support staff to handle calls, which is nice. Most companies don't.

For example, Dell's support isn't what it used to be. Now you get put in a long wait queue even if you purchased enterprise hardware such as servers or tape libraries...that is unless you buy their "gold" support which I find to be ridiculously expensive.

Now I just need to wait until the morning after the nightly backups are done in order to install the patch. Then we get to see if the patch fixes the user's problem.

The problem can also occur with similar users connecting to Exchange 2000.

Document Management Systems

Working on our DMS today. We use WORLDOX, which is a DMS tailored to the legal profession.

Whoever originally set up our DMS did a horrible job and so I'm doing cleanup in preparation for moving the DMS and all of our other server based apps and files from the current Novell 5.1 servers to the new Dell PE 2650 Win 2003 server.

I'm still trying to figure out the best way to set up the directories and metadata fields to make it easier for everyone to find the documents they need and to also make it easier to keep field entry standardized.

Right now, we have too many generic doc types and practice areas in those two search fields so some people tag a standard document as a document and others as misc. Part of it's a training issue which we are also working on, but my boss, the "tech" partner and I think that the field structure should be much simpler. Limited to Client number, matter number, author and typist.

Would be helpful if there was at least one good book on administering WORLDOX, but I haven't been able to find one.

Anyone else out there have any DMS suggestions, books to read on the subject or informative websites?