Client Updating-Nod32 Enterprise

I have been scanning through the ESET P of O docs I dl'd back in February. I am trying to figure out what mechinism(s) in the client SW and the LanUpdateServer SW cause the clients to update their vdef versions AFTER I manually use the RAS to get new updates from ESET. I use dialup. I call into ESET roughly morning, noon, and night to keep current. Does anyone have information about this?

From my reading, I get that RAS talks to ESET and brings in any updates that are new. I suspect that ESET really talks to my LanUpdate Server through the RAS to determine what needs to come down the pipe to me. Once in hand, I suspect that the LanUpdateServer updates its' client (on my server with the RAS) and the Mirror. From this point I am completely baffled as to how to tweak/customize my LAN clients to update as quickly as possible. (I have one client that just will not get with the program )

I have watched my RAC for the last several days with refresh set to 1 minute. I notice that 3 of my clients show "updated" within 6-10 minutes. But one of my clients sits very quiet and often takes up to 60 minutes to update. I do have all clients set for:
Nod32ControlCenter/SystemTools/SystemSetup/Setup/RemoteAdministration/
Connect to RAS: checked
Server address: srv (should I change this to its' ip address?)
port: 2222
Interval between connection to server: 5 minutes

But, I am confused as to how to set my client's Update Schedules to speed up their updates. Help here would be greatly appreciated. I really do like Nod32 Enterprise and plan on a long partnership with ESET
Best,
Duncan

 

RAS does not communicate with Eset's servers at all. It's only the update module that downloads update files that are subsequently stored by the mirror module in a so-called mirror for further distribution within LAN.

 

Marcos,
Thank you for your reply. Then RAS is the "my side" force that moves updates from my LanUpdateServer to my Mirror? Seems very odd for 23.5MB of code, but I'll take your word for it.

So, what mechanism moves any/all updates from the Mirror to the clients? I do not push stuff to my clients, because I do not completely comprehend the "build" process. Yes, I have reviewed Blackspear's excellent tutorial, but I still get errors when choosing/building a "config.xml" for the package. (This is a separate issue, and will raise a thread when finished studying.)

I am just trying to optomize each client so that they get updates as fast as possible. Without a "push task" from my RAC, what is the soonest any client can/will update after my Mirror is updated? The minimum "1 hour" seems awful long.

If I do go into my Scheduler/Planner and edit my "update" tasks, do I have to reboot the machine for the edits to take?

An hour ago (and before getting the 2285 update) @1340 EDST, I changed each client's update tasks to read:
Task: NOD32 Update
Name: Regular automatic update
Scheduled: Event triggered-Successful update of the virus signature database.
In case it fails to be performed at scheduled time: Task will be run as soon as possible.
Special Task settings: My Profile (can not set back to <none>)

Task: NOD32 Update
Name: Regular automatic update
Scheduled: Event triggered-Successful update of the program components.
In case it fains to be performed at scheduled time: Task will be run as soon as possible.
Special Task settings: My Profile (can not set back to <none>)

In the two tasks above, whose [database] is referred to? The client database, or, the Mirror database? It is now 1558 EDST and 3 of my clients remain at signature file 2284. They have not updated. I am very confused with this.
Thanks,
Duncan

 

The clients check into the main server...and "pull" updates if available, just like they do if a stand alone client..checking in with Esets public servers.

I believe the default time period for checkin is every 5 minutes.

 

YeOldeStonecat,
I would be very happy if what you say were true. I have yet to see any of my clients update within 5 minutes of the Mirror update. Can you share setting for this "5min pull?"

For now, the settings I posted in my previous just do not seem to work at all. I had to do to each client and force a manual update to move them from 2284 to 2285. I am now going to deselect any/all scheduled update tasks and retest later when I do my nightly call for updates. This is truly confusing.
Best,
Duncan

 

There's no setting I flip for anything like 5 minutes...I believe it's default. In the dozens and dozens of EE installs I've done...I see clients update definitions very shortly after they reboot from the install.

I think what you may need to wait for is a workstation to reboot after a program component update.

 

Helo,

Clients look for updates when booting up and then once an hour.

They will check in with the Remote Administrator every 5 minutes for new tasks, but their update schedule is hourly.

BFG

 

YeOldeStonecat,
OK. Understand, but I'm not talking about a client reboot or a program component update. Have been watching my clients doing a "normal" sig update after my Mirror gets updated. I may have fixed something by returning to the default "repeatedly-at least 1 hour" setting.

This am at 0842 I dl'd the 2286 sig update. I used my task manager display of CPU activity to time when the update was in-house and complete on the server. This tells me the Mirror and server's client are updated. The Nod32 CC confirmed this status.

At 0845 my server's client (and the Mirror, I suspect?) popped into RAC and turned from red to black (updated). 21 minutes later at 0906 one of my other clients showed updated (red-to-black) in the RAC. Then 15 minutes later my last 4 clients showed updated (red-to-black) between 0921 and 0923 (like a swarm!) in the RAC

With just some simple linear math, I see 46 minutes from start to finish for sig update 2286 across 5 clients (43 minutes not counting the Mirror update), so that is ~8 minutes/client. I suppose I can live with this until I can figure out how to tune my server, clients, and LAN if possible.

Thanks for your comments. I suspect the perceived 5 minute query cycle is good choice. And, I have fixed the problem of one client either not updating or taking very long to update.

On a larger LAN with many more clients I could see a server and LAN getting swamped by needless client queries for updates. Hmm.....
Best,
Duncan

 

I supposed other factors can create varied performance....across different networks.

Server load of the RAS box might be one....

I prefer to do everything IP based....clients look to the mirror via IP address, and clients look to remote management server via IP address. I know it works using netbios names...but that makes them hit the DNS server for name resolution..causing more of a load for DNS service(s). If you consider larger networks..clients checking in every 5 minutes....that's a lot of little hits to DNS for name resolution. I use IP...cut out that step.

 

YeOldeStonecat,
Yes, I've have noticed that many things, often seemingly unrelated, do affect LAN performance. And yes, I do like to set up net clients for ip address focus. However, when getting into the EE install tutorial, I noticed that the reccomendation was to use HTTP-based communication between client and server. Believe I did ask here as to why HTTP over straight IP address, but have now forgotten the rationale for HTTP. Now, I'm a bit afraid to try and go back and try to switch. (the if it ain't broke, don't fix it rule!)

Separate question: Which dot.xml file does a client's <My Profile> settings live in? I was looking at a dot-xml file in my server's ESET directory labled "nod32.xml." I suspect that I updated this file today based on its' date/time stamp. Odd. Do not recall changing anything!

Did find the "Mirror/settings" section and I noticed that the setting "Enable HTTP Server" was set to NO. Is this correct? Would think that as I use HTTP server port 8088 for the Mirror, the server should be enabled.

The more I learn about Nod32, the more complicated it gets!
Best,
Duncan

 

BFG,
Thank you. Yes, that is about what I am seeing. So, if I want the clients to update quicker than once an hour, I have to build an update package and push it to the clients?
Best,
Duncan

 

IP over http. You can pull up an http site via DNS name, or via IP address. It's not a "one or the other"...it's a "Use IP to locate the http mirror".

http://192.168.1.11:8081
instead of
http://servername:8081

 

YeOldeStonecat,
Oh. OK. Got it. That is how I am set up for client-server comm.
Back to the books.
Best,
Duncan

 

Hi Cosmo32,

You could right click on the clients and go New Task > Update now.

They will not try to update however until checking in with the Remote Administrator, which by default is the 5 minutes.

BFG

 

BFG,
That is a really neat trick!
I just tried it after an update to 2292. RAC entered the task and all the three laggard clients did update within 5 minutes.
Looks like I've found a good work-around. And, I have used RAC to push my first task! Thank you for this tip.
Best,
Duncan

 

Thank you for using NOD32!