The Symantec Endpoint Protection Manager displays an error which reads "Datastore error"

Article:TECH189009  |  Created: 2012-05-17  |  Updated: 2012-11-19  |  Article URL http://www.symantec.com/docs/TECH189009
Article Type
Technical Solution

Product(s)

Issue



The Admin > Servers page within the Symantec Endpoint Protection Manager (SEPM) 12.1 displays an error which reads "Datastore error" on a regular basis.  AV logs from some SEP clients may not be displayed in SEPM risk reports.


Error



The timestamps of the errors in the SEPM correspond to errors in scm-server-0.log similar to the following:

 2012-05-09 14:50:09.187 THREAD 39 SEVERE: Datastore error in: com.sygate.scm.server.task.AgentAVLogCollector
java.lang.ArrayIndexOutOfBoundsException: 14
at com.sygate.scm.server.logreader.av.ParseSecurityRecord.parseNativeLogRecord(ParseSecurityRecord.java:435)
at com.sygate.scm.server.logreader.av.ParseSecurityRecord.parseSEPLogRecord(ParseSecurityRecord.java:262)
at com.sygate.scm.server.logreader.av.LogHandler.parseSEPLog(LogHandler.java:173)
at com.sygate.scm.server.logreader.av.LogHandler.process(LogHandler.java:109)
at com.sygate.scm.server.task.AgentLogCollector.enumerateInbox(AgentLogCollector.java:255)
at com.sygate.scm.server.task.AgentAVLogCollector.collectLogs(AgentAVLogCollector.java:33)
at com.sygate.scm.server.task.AgentLogCollector.execute(AgentLogCollector.java:86)
at com.sygate.scm.server.task.MonitoredTimerTask.run(MonitoredTimerTask.java:22)
at java.util.TimerThread.mainLoop(Timer.java:512)
at java.util.TimerThread.run(Timer.java:462)
com.sygate.scm.server.util.ServerException: Datastore error
at com.sygate.scm.server.logreader.av.LogHandler.process(LogHandler.java:142)
at com.sygate.scm.server.task.AgentLogCollector.enumerateInbox(AgentLogCollector.java:255)
at com.sygate.scm.server.task.AgentAVLogCollector.collectLogs(AgentAVLogCollector.java:33)
at com.sygate.scm.server.task.AgentLogCollector.execute(AgentLogCollector.java:86)
at com.sygate.scm.server.task.MonitoredTimerTask.run(MonitoredTimerTask.java:22)
at java.util.TimerThread.mainLoop(Timer.java:512)
at java.util.TimerThread.run(Timer.java:462)


Cause



One or more Symantec Endpoint Protection clients is forwarding invalid logs to the SEPM. The SEPM is unable to process the invalid logs which generates the "Datastore error" error messages.


Solution



This issue has been fixed in Symantec Endpoint Protection 12 Release Update 2 (RU2).  For information on how to obtain the latest build of Symantec Endpoint Protection, read TECH 103088: Obtaining an upgrade or update for Symantec Endpoint Protection or Symantec Network Access Control.


Supplemental Materials

SourceETrack
Value2588017 / 2860247


Article URL http://www.symantec.com/docs/TECH189009


Terms of use for this information are found in Legal Notices