> Source: [sk106861](https://support.checkpoint.com/results/sk/sk106861)

# sk106861 - Endpoint Security Server and Endpoint Security Client show different version of the installed Anti-Malware signature

| Property | Value |
|----------|-------|
| Solution ID | sk106861 |
| Date Created | 2015-07-21 |
| Last Modified | 2020-12-21 |
| Technical Level | Advanced |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X, R82.x, R82.20, R82.10, R82, R81.20 |
| Platform | Intel/PC |

## Symptoms

- * Endpoint Security Server and Endpoint Security Client show different version of the installed Anti-Malware signature.

  *Example*:
  * Endpoint Security Server

    [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106861/Server.jpg)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106861/Server.jpg "Click the image to see it in full size in a new tab/window")   

  * Endpoint Security Client

    [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106861/Client.jpg)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106861/Client.jpg "Click the image to see it in full size in a new tab/window")
* Endpoint Security Client GUI and Endpoint Security Client log files (cpda.log, epslog.\*.log, SmartView Tracker logs) show different version of latest Anti-Malware signature.

  *Example*:
  * cpda.log

    ```
    
    20140902 18:18:09.005   c50 Provider(s) from DSM: DAF_DSM: <provider name="antivirus">
        <properties>
            <property name="datDate" value="2014-09-02 15:56:00 +09:00"/>
            <property name="datVersion" value="201409021556"/>
    ```

  * epslog.\*.log

    `
    [2014-09-03 14:02:18] event=UEPM:Anti-Malware:Update event_id=131076 product_family= event_uuid= user_name=***** src_user_name=***** src=***** src_machine_name=***** machine_guid= user_sid=***** event_type=Update UTC=1409688138 local_time=1409720538 Severity=1 product=Anti-Malware description= client_name= client_version=8.4.185 installed_products=383 host_type=Desktop os_name=Windows 7 Enterprise Edition os_version=6.1-7601-SP1.0-SP connectivity_state=Connected failed_updates=0 am_update_source=***** am_update_proxy= __policy_id_tag=product=Anti-Malware[db_tag={*****};mgmt=Enpdoint Management;date=1400569156;policy_name=Default Anti-Malware settings for the entire organization;policy_number=2] `***sig_ver=201409021327***` en`

## Cause

* **Endpoint Security Server and Endpoint Security Client show different version of latest Anti-Malware signature.**

  Cosmetic issue - Endpoint Security Server and Endpoint Security Client use different methods for determining the signatures version. As a result, different version is returned for the same signatures.   

* **Endpoint Security Client GUI and Endpoint Security Client log files (cpda.log, epslog.\*.log, SmartView Tracker logs) show different version of latest Anti-Malware signature.**

  Endpoint Security Client uses cached engine version and signatures information instead of updated information when signature update completion message arrived and new logs are sent to the Endpoint Security Server.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content