Best Scheduled Source Pull Time

[DeanBaker]

Hi All.

Roughly what time do McAfee put the daily DAT updates on their HTTP source site for download? I am looking to setup a scheduled pull task in ePO 4.0 and dont want the task to run too early so I miss the updates or run too late so I have no time left to run a scheduled repository replication task. I am in the UK and would like to run the pull task in the evening sometime when the users have gone home for the day. From looking at the link https://update.nai.com/Products/CommonUpdater I can see that todays files were there at "21-Jun-2009 11:59" but where is it picking that time up from? Is it a UK / US time?????

Any help is most appreciated.
Dean

[jsuuronen]

judging on the emails that i get when the DATs come out (supposedly), they seem to be released between 12-2pm EST and towards the end of that window as well.

[twenden]

Looking at our pull tasks logs for the last 3 days, it appears that McAfee releases the DAT between 11.30am and 12.30pm Central Standard Time.

We configure our server to run a pull task every 15 minutes. That way we can catch those emergency DATS that might get released. Also, our pull tasks do fail on occasion which appears to be everyone hitting the McAfee update sites at the same time.. That is one reason that we run pull tasks every 15 minutes so that we can eventually get the DAT.

[Travler]

I concur with twenden on when McAfee releases the daily dat. However, I'm not as concerned with getting the dat immediately, mainly because of the "bad" dats that McAfee releases once or twice a year. I have three Pulls scheduled: one in the early afternoon, one in the late afternoon, and one at 5am. If our network or systems start acting up, I can simply look at the time and know whether or not the daily dat needs to be investigated as the culprit. And, although I'm not here at 5am, I'm not too concerned about it because McAfee does a pretty good job of releasing corrected dats in a timely manner. (In other words, I'm fairly confident a bad dat would be corrected before 5am.)

I guess everyone needs to weigh the risks of a zero day attack vs the potential downtime of a bad dat in their environment. We have enough layers of protection to allow me to be comfortable waiting an hour or two for the daily dat to avoid the occasional bad dat.

[DeanBaker]

Hi All.

Thanks so much for your answers, they have been of great help. I have now put something in place as of today and will see how it goes by tomorrow morning. I now a source pull at 6, 7, 8 & 9pm UK time (incase one of the pull tasks fails due to the NAI servers being busy) and then repo replications throughout the early hours of the morning. I have to replicate at this time as the repos are in remote sites with some on slow ADSL and I dont want to interfere with the backups. Hopefully all will be well in the morning.

Once again the forums have tomy rescue before McAfee Tech Support.

Cheers
Dean