locked
Onecare eating 3GB of bandwidth from my computers daily! RRS feed

  • Question

  • I'm running Onecare Server on SBS2008 and I have 13 XP clients tied to it.  Since May 22, 2009, most of my Onecare clients at 2am (when the tune-up begins) start downloading/transferring between 300MB and 750MB individually a day.  Collectively I have transferred to/from live.com servers over 3GB a day.  I am now being throttle by my service provider for daily usage becuase of this! 

    I suspect it is downloading Microsoft Updates??  I don't need it to becuase I'm running WSUS on my SBS2008 server.

    Can someone explain what has changed since May 22, and why my machines are now transferring so much data when previous to May 22, 2009 transfers to live.com servers were in the kilobytes collectively.

    Here is a daily report from my firewall for May 25.  Again this is happening daily!!!!!!

    65.54.87.33    cds30.sjc9.msecn.net    572.2 MB    7.98 %     
    65.54.87.93    cds90.sjc9.msecn.net    480.8 MB    6.71 %     
    65.54.87.19    cds16.sjc9.msecn.net    334.3 MB    4.66 %     
    65.54.87.188    cds182.sjc9.msecn.net    303.4 MB    4.23 %     
    65.54.87.96    cds93.sjc9.msecn.net    276.8 MB    3.86 %     
    65.54.87.20    cds17.sjc9.msecn.net    269.0 MB    3.75 %     
    65.54.87.84    cds81.sjc9.msecn.net    228.4 MB    3.19 %     
    65.54.87.82    cds79.sjc9.msecn.net    186.6 MB    2.60 %     
    65.54.87.22    cds19.sjc9.msecn.net    1152.9 MB    2.13 %

    Please Help!
    • Edited by DustinC24 Tuesday, June 2, 2009 3:46 PM
    Monday, June 1, 2009 5:59 PM

Answers

  • Yes, thanks for the help and the links above.  In two of the computer a simple reboot (I guess it had been a while) cured the system and it updated virus protection properly.  One computer required the CleanDatabase tool and two computers required uninstalling and reinstalling, but all is well now and showing green across the board.  Today only 51MB has passed to live.com servers.  I appreciate the help.  It may have been several weeks since these machines have been rebooted so who knows what the problem may have been.

    Thanks again!

    - Dustin
    Tuesday, June 2, 2009 3:49 PM

All replies

  • OneCare does not download Microsoft updates. OneCare does download the signature definitions, but the updates are tiny except for a monthly refresh that is probably in the area of 15 to 20 megs in size. OneCare checks for updates and warsn the user if important or critical updates are missing, but it does not download them. In any event, that much data would not be updates for Windows.
    You are running a daily tune-up on each machine? Why? The default is once per month. Has one of your clients perhaps signed up for Photo Backup? That's the only thing I can think would be uploading from a client.
    Are you seeing this traffic from all machines? Does it happen if Tune-up is not run? Are the PCs sleeping before Tune-up executes?
    -steve

    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Monday, June 1, 2009 6:53 PM
    Moderator
  • Sorry the tune-up part was incorrect also it isn't happening from all 13 of my clients every day.  The tune-up settings are at the default which is once every 4 weeks. 

    When I correlate the IP's today that have used the gross amounts they are all showing out-of-date virus protection.  So I believe something is wrong with virus protection updates.  Perhaps virus definitions are downloading improperly and keep cycling.  Here is my bandwidth today on these five machines showing out-of-date virus protection:

    This table shows my internal clients and their specific usage which the same machines in Onecare show out-of-date virus protection.
        
    IP     Hostname     Packets     Traffic     % of total
    192.168.100.41     n/a     1 108 409     876.7 MB     12.55 %
    192.168.100.42     n/a     1 090 506     843.9 MB     12.08 %
    192.168.100.48     n/a     914 599     700.3 MB     10.03 %
    192.168.100.44     n/a     775 201     617.8 MB     8.84 %
    192.168.100.32     n/a     452 751     269.2 MB     3.85 %
    192.168.100.43     n/a     244 239     151.5 MB     2.17 %

        IP                 Hostname                       Packets     Traffic     % of total
    65.54.75.8        cds3.lax9.msecn.net         813 817     661.5 MB     9.47 %
    65.54.75.162     cds157.lax9.msecn.net     516 995     436.5 MB     6.25 %
    65.54.75.141     cds136.lax9.msecn.net     456 172     360.0 MB     5.15 %
    65.54.75.131     cds126.lax9.msecn.net     425 501     329.6 MB     4.72 %
    65.54.75.116     cds111.lax9.msecn.net     391 535     316.7 MB     4.53 %
    65.54.75.79       cds74.lax9.msecn.net       368 184     295.8 MB     4.23 %
    65.54.75.62       cds57.lax9.msecn.net       318 212     245.0 MB     3.51 %
    65.54.75.122     cds117.lax9.msecn.net     302 155     234.8 MB     3.36 %
    65.54.75.149     cds144.lax9.msecn.net     309 162     233.6 MB     3.34 %
    65.54.87.22       cds19.sjc9.msecn.net       296 598     230.4 MB     3.30 %


    How large is a typical daily virus-update definition?

    Monday, June 1, 2009 7:31 PM
  • The typical definition updates are tiny - measured in KBs, not MBs. The monthly refresh is less than 20 megs.

    I would try forcing an update on the machines that seem to be exhibiting the problem by resetting the database - treat it as a typical update problem and see the instructions here:
     

    http://social.microsoft.com/forums/en-US/onecareupdate/thread/9a6a0003-b91c-4518-966c-fc50450f0e41/

    Let us know if this resolves it. I can't imagine why it is happening, though. OneCare checks for updates at startup of the PC and then several times daily. If the PCs are on 24 hours per day, they will check 3 or 4 times in most cases. The PC will not wake to check for updates if sleeping/standby.
    -steve


    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Monday, June 1, 2009 7:56 PM
    Moderator
  • Any update on this problem, carroldc_dcc24?

    -steve
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Tuesday, June 2, 2009 12:55 PM
    Moderator
  • Yes, thanks for the help and the links above.  In two of the computer a simple reboot (I guess it had been a while) cured the system and it updated virus protection properly.  One computer required the CleanDatabase tool and two computers required uninstalling and reinstalling, but all is well now and showing green across the board.  Today only 51MB has passed to live.com servers.  I appreciate the help.  It may have been several weeks since these machines have been rebooted so who knows what the problem may have been.

    Thanks again!

    - Dustin
    Tuesday, June 2, 2009 3:49 PM
  • Thanks for the update, Dustin. That sure was an odd issue that I've never seen before, but it sounds like these PCs were in some terrible infinite update loop that was failing miserably. Glad that it appears to eb resolved.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Tuesday, June 2, 2009 4:36 PM
    Moderator
  • I'm seeing the same issue only it is being done by my WSUS Server.  How does one resolve this?  I'm blocking the domain for now.  It appears that my WSUS store is nearly 80GB.  Is that normal???
    Friday, October 16, 2009 9:28 AM
  • I'm seeing the same issue only it is being done by my WSUS Server.  How does one resolve this?  I'm blocking the domain for now.  It appears that my WSUS store is nearly 80GB.  Is that normal???

     

    You're off topic for this forum, which is dedicated to Windows Live OneCare.

    It is my understanding that the WSUS server downloads and holds all of the available Windows Updates. 80 gigs seems reasonable to me.
    You should head over to this forum for discussion of WSUS - http://social.technet.microsoft.com/Forums/en-US/winserverwsus/threads
    -steve


    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Friday, October 16, 2009 12:16 PM
    Moderator