Symantec Auto Run Policy

Content Authoring
1

(imported topic written by SystemAdmin)

Hello,

Did anyone use the fixlet ‘UPDATE: Outdated Symantec Anti-Virus Corporate Edition Virus Definition Detected - Auto Run Policy Version’ to update Symantec virus definition ?

I see some kind of restrictions in the description part of the fixlet, can anyone explain pro and cons using this fixlet?

Thanks in advance!

2

(imported comment written by BenKus)

Hi Marie,

This particular Fixlet will make the agents download their dat updates directly from Symantec (rather than through the relay chain) and so this is most applicable for mobile computers on the Internet rather than computers in a corporate setting (if you use this inside the company, then you might have proxy and bandwidth issues).

Ben

3

(imported comment written by SystemAdmin)

Hi Ben thanks for your answer!

I am basically interested in this part"{(key “Def Version” of section “Symantec” of file “avconfigsymantec.ini” of client folder of site “http://sync.bigfix.com/cgi-bin/bfgather/avclient”) as string}" and how it gets the version of the update file from the .ini on the bigfix site file unlike the ‘UPDATE: Outdated Symantec Anti-Virus Corporate Edition Virus Definition Detected’ fixlet that is each time updated with the new version update file.

i tried to use a simple ‘download’ command instead of ‘download now’ but this didn’t work, error message on the console 'Unable to parse action script for Action 1 line 1. Relevance substitution is not allowed.'so my question is : is the download now commande related to the way the fixlet is trying to find the file version from the ‘avconfigsymantec.ini’?

4

(imported comment written by BenKus)

Hi Marie,

You have basically spotted the key elements of this approach we are using:

  • We update the ini file each time the dat file is updated.
  • You can only use relevance substitution in the “download now” command and not the “download” command (due to the way the download command pre-caches files on relays).

Ben

5

(imported comment written by jessewk)

Also, in 7.2 and later you can use relevance substitution in the ‘add prefetch item’ command as well.

6

(imported comment written by SystemAdmin)

Ben and Jesse, thanks for those useful infos! i may missed this part for the new version…

7

(imported comment written by SystemAdmin)

hello again,

i was testing this simple code

begin prefetch block

add prefetch item name=avconfigsymantec.ini sha1={“72d56354ed20f3a396a49553fbf3b59b73fcdb15” as lowercase} size=109 url={“http://sync.bigfix.com/bfsites/avclient_1754/avconfigsymantec.ini”}

end prefetch block

The status of the fixlet is ‘Pending Download’ and when i looked in the logs i found that the action is always reporting " ItemizedDownloadsAvailable: false (action id 599) "

is there anything wrong with the code?

8

(imported comment written by jessewk)

Hi marie,

I think you are trying to automatically download the ini file without re-issuing actions? Unfortunately you’re not going to be able to get that to work with your strategy above. I mentioned relevance subsitution using prefetch blocks in my previous post so that readers of the thread will know that there are certain instances where relevance subsititution is allowed other than the ‘download now’ command.

Please read the following thread for a complete discussion of the options avialable for downloading dynamic content:

http://forum.bigfix.com/viewtopic.php?id=4598

Jesse

9

(imported comment written by SystemAdmin)

Hi Jesse,

Thanks for this specific forum you provided and the very useful infos inside!

I still don’t understand for the code i was trying to test , why the download action was not performed? however i am providing the shad for this specific file…

Thanks again for your help and support on this.

10

(imported comment written by jessewk)

Try removing the relevance evaluation:

begin prefetch block

add prefetch item name=avconfigsymantec.ini sha1=72d56354ed20f3a396a49553fbf3b59b73fcdb15 size=109 url=http://sync.bigfix.com/bfsites/avclient_1754/avconfigsymantec.ini

end prefetch block

11

(imported comment written by SystemAdmin)

Thanks Jesse it is working by removing the relevance evaluation, the file is downloaded, but the status of the action is ‘failed’, is this normal?

12

(imported comment written by jessewk)

It depends on the option you selected on the success criteria tab. You probably selected ‘relevance evaluates to false’ and it didn’t become false by the time the action completed.