SAV LiveUpdate

[#1]

Has anyone else been experiencing problems with using the "runSAVLiveUpdate.sh" script from the Resource Kit? I've found that on some computers, it just hangs indefinitely, leaving an unresponsive LiveUpdate icon in the Dock that can't be killed using Force Quit (thus preventing logout).

I think I found out why. Here's an excerpt from the logs of one of the Macs that exhibited this behavior last night when I pushed the update:

3/2/11 7:32:17 PM LiveUpdate[14907] 3891612: (connectAndCheck) Untrusted apps are not allowed to connect to or launch Window Server before login.
3/2/11 7:32:17 PM LiveUpdate[14907] kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
3/2/11 7:32:17 PM /Applications/Symantec Solutions/LiveUpdate.app/Contents/MacOS/LiveUpdate[14907] _RegisterApplication(), FAILED TO establish the default connection to the WindowServer, _CGSDefaultConnection() is NULL.

It looks like the application is trying to launch its GUI, which fails because nobody is logged in. But for some reason, it ignores the error and stays open anyway. Then when a user does log in, it shows up in the Dock, but is unresponsive because it has no connection to the Window Server, and Force Quit doesn't work because it's owned by root. Fortunately, it can be killed using Casper Remote's "kill process" feature (enter "LiveUpdate").

This version of the script runs LiveUpdate as a logged-in user, or returns an error if nobody is logged in:

#!/bin/sh
####################################################################################################
#
# Copyright (c) 2010, JAMF Software, LLC. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
# Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
# * Neither the name of the JAMF Software, LLC nor the
# names of its contributors may be used to endorse or promote products
# derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
####################################################################################################
#
# SUPPORT FOR THIS PROGRAM
#
# This program is distributed "as is" by JAMF Software, LLC's Resource Kit team. For more
# information or support for the Resource Kit, please utilize the following resources:
#
# http://list.jamfsoftware.com/mailman/listinfo/resourcekit
#
# http://www.jamfsoftware.com/support/resource-kit
#
# Please reference our SLA for information regarding support of this application:
#
# http://www.jamfsoftware.com/support/resource-kit-sla
#
####################################################################################################
#
# ABOUT THIS PROGRAM
#
# NAME
# runSAVLiveUpdate.sh -- Run Symantec LiveUpdate.
#
# SYNOPSIS
# sudo runSAVLiveUpdate.sh
# sudo runSAVLiveUpdate.sh <mountPoint> <computerName> <currentUsername>
#
# DESCRIPTION
# This script will run the Symantec LiveUpdate application in the background which will silently
# download and install the latest virus definitions available from Symantec.
#
# This script expects Symantec LiveUpdate to be installed at:
#
# /Applications/Symantec Solutions/LiveUpdate.app
#
####################################################################################################
#
# HISTORY
#
# Version: 1.1
#
# - Modified by Ben Urban on March 3rd, 2011
# - Reports an error if nobody is logged in, instead of hanging indefinitely
#
# Version: 1.0
#
# - Created by Nick Amundsen on August 6th, 2008
#
####################################################################################################
#
# DEFINE VARIABLES & READ IN PARAMETERS
#
####################################################################################################
if [ -f "/Applications/Symantec Solutions/LiveUpdate.app/Contents/MacOS/LiveUpdate" ]; then
# Find the name of any user who is logged in; doesn't matter who
anyuser=$(/usr/bin/who | /usr/bin/grep 'console' | /usr/bin/head -n 1 | /usr/bin/cut -f 1 -d ' ')
if [ -n "$anyuser" ]; then
echo "Running LiveUpdate as $anyuser..."
/usr/bin/su - "$anyuser" << EOF
"/Applications/Symantec Solutions/LiveUpdate.app/Contents/MacOS/LiveUpdate" -update LUal -liveupdatequiet YES -liveupdateautoquit YES
EOF
else
echo "Error: Symantec LiveUpdate doesn't work without a user logged in."
exit 3
fi
else
echo "Error: Symantec LiveUpdate was not found on this machine."
exit 1
fi

[#2]

Ah, thanks. I hadn't had a chance to look at that Resource Kit yet.

[jwojda]

Yes, we've had that.

I talked to Symantec's support and they said doing the script that way
can cause problems with machine lockups.

They recommended using "symsched" instead to schedule updates.

John Wojda
Lead System Engineer, DEI
3333 Beverly Rd. B2-338B
Hoffman Estates, IL 60179
Phone: (847)286-7855
Page: (224)532.3447
Team Lead: Matt Beiriger

[#4]

Did they indicate any potential problems running it as the logged-in user the way my version of the script does?
Did they say when they plan to fix the bug?

[talkingmoose]

We ran into this after upgrading to Mac OS X 10.6. Snow Leopard has
On 3/3/11 10:52 AM, "Urban, Benjamin Mark" <BUrban at imf.org> wrote:
increased security that causes the command line LiveUpdate to fail.

SEP 11.0 supposedly doesn't have this issue.

--

William Smith
Technical Analyst
Merrill Communications LLC
(651) 632-1492

[jhalvorson]

The version of the SAV LiveUpdate script included with the Feb 2011 resource
kit works for us when no one is logged in.

http://jamfsoftware.com/support/resource-kit

This is from the script:
# HISTORY
#
# Version: 1.1
#
# - Created by Nick Amundsen on August 6th, 2008
# - Updated by Nick Amundsen on November 22nd, 2010
# - Fixed an issue that prevents LiveUpdate from running when the
machine is at the loginwindow
# and improved error logging.

Jason

[golbiga]

I've used symsched and I've had mixed results. What's the best way to make sure that all your machines are getting the def updates? I like that symsched is silent, but I find that it doesn't always run when expected (if at all).

Thanks
Allen