Symantec Endpoint Protection: Event ID 4097 and 4096 occur near 4:00 AM on a Windows 2003 Small Business Server

Article:TECH103105  |  Created: 2007-01-14  |  Updated: 2009-01-03  |  Article URL http://www.symantec.com/docs/TECH103105
Article Type
Technical Solution

Product(s)

Issue



Event IDs 4097 and 4096 are listed in the Windows Event Logs at 4 AM on a Windows 2003 Small Business Server.

Symptoms
In the Application Log of the Windows event viewer there are the following errors reported by secars:
  • Event ID 4097: src = seacars ... "Failed to start radius server the radius port may be used by another process. "
  • Event ID 4096: src = secars ... "Create log file error ... "

Net Stat shows that nothing is running on port 1812




Cause



Symantec Endpoint Protection stops "secars" to allow the Exchange maintenance cycle. The Exchange maintenance cycle starts at 4 AM by default on a Windows 2003 Small Business Server.

Solution



This problem is fixed in Symantec Endpoint Protection Manager 11.0.2000 build 1567.

For information on how to obtain the latest build of Symantec Endpoint Protection, please read the following document:
Obtaining an upgrade or update for Symantec Endpoint Protection 11.x or Symantec Network Access Control 11.x.




Supplemental Materials

SourceETrack
Value1200391

Legacy ID



2007121415002348


Article URL http://www.symantec.com/docs/TECH103105


Terms of use for this information are found in Legal Notices