Clients updating from Internet and not from EAS

[REDACTED]

Hi All:

Beginning 11/11/14, many of our client machines spontaneously began updating their virus definitions from the internet rather than getting them from our internal EAS server.  All of the updates begin simultaneously at 43 minutes past every hour and continue until 48 past the hour.   This is bringing our internet bandwidth to a crawl as seen from the attached image.  We've been using Avast for a year and a half with no issues - this has cropped up out of no where.  We've rebooted the EAS server to no avail.

As I stated above, not every client machine is exhibiting this issue, which makes it difficult to troubleshoot.  Interestingly, when running a manual definition update from a client that is exhibiting the problem, the correct DNS entry for our internal EAS server is displayed and the update runs without a problem. It seems to be the "scheduled" update that is causing the issue.  We've unchecked "Try to find an alternative server if unavailable" in the Communication settings as well as unchecked "If mirror is unreachable, update from the Internet."

We would appreciate any help that can be provided.  Thank you.

[REDACTED]

Assuming you can still deploy and manage the machines, it sounds to me like a DNS issue.

In the avast5.ini, of the client try to enter the server IP address as opposed to host name
The avast5 file is here by default: C:\ProgramData\AVAST Software\Avast

If this doesn't work, try to install another console somewhere else in your environment and have a single client report to it. If you can get that machine updating through the console, then it's that there's something going on with that local machine, or possibly the application that is blocking communication.

[REDACTED]

Max:

Interestingly, at midnight on 11-15/11-16, the clients totally stopped updating from the internet and started updating back to our internal server.  Nothing in our environment changed - they just started working again at that time. 

I say this to bring up the fact that the problem has since resurfaced beginning this morning.  I've verified DNS is working internally, we'll try pushing out the static IP rather than DNS to the avast5.ini file just to see.