The Log.LiveUpdate file is missing or out of date on a Symantec Endpoint Protection (SEP) 12.1 client
The LiveUpdate log of a Symantec Endpoint Protection (SEP) 12.1 client needs to be reviewed. However, nothing is being logged to the Log.LiveUpdate file, or the file is missing completely.
Unlike previous versions of (SEP), the 12.1 version of the SEP client does not use LiveUpdate to get content updates. Instead, it uses LiveUpdate Engine (LUE).
LiveUpdate Engine does not log to the Log.LiveUpdate file, like LiveUpdate. However, if the client was migrated from a previous version of SEP the file may still exist, if it was not removed during or after migration.
NOTE: The Symantec Endpoint Protection Manager (SEPM) version 12.1 still uses LiveUpdate, so the Log.Liveupdate file will exist on a 12.1 SEPM.
LiveUpdate Engine creates a log file called Log.Lue. This log can be found in the following location when LUE was run on a self-managed client:
On Windows XP and Windows server 2003:
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs
On Windows Vista, Windows 7, and Windows Server 2008:
C:\Program Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs
Note that the log.lue is not generated if the client receives its updates from a SEPM or Group Update Provider (GUP). Managed SEP 12.1 clients only record high-level details of update activity ("Definition File Loaded") in the System log of the Virus and Spyware Protection Logs and in the Windows Application Event logs.