Hi,

I am facing some issues with SEPM so I run the Manager configuration wizard with the intention to repair the SEPM after completing the wizard I restored the database with backup as on date of 31 March 2014 around 900 clients are added to SEPM at that time .

Restoration of database completed sucessfully but the issue is that clients are not communicating with SEPM manager are all of them showing Offline and I am also getting error of Apache again and again on the server on which SEPM is installed.

Please guide me what I have to do to make these clients again communicating with SEPM abd to fix this Apache error.

 

Regards

Geekgadget

What happens after replacing the sylink file on one affected client?

Restoring client-server communications with Communication Update Package Deployment

I didn't replace sylink file on the clients

Can you test on one?

Is the SEPM service started? Can you login to the console?

Yes SEPM service is started and I am able to Login into the console.

I will generate the Sylink and test on one client but Brain as I mentioned that I have around 900 clients

and they are not online in a day I have some points to clear.

1.As I have run the server config wizard and restore the database if I create a new Sylink file then

a.I am not very much clear how  push Sylink file on clients which are in diffrent groups which I have created please guide for this doubt.

b.All systems are not online at once so those clients which come online after one or two days will they get this new Sylink config file by themself when they come online or what will be the scenario.

If you followed the steps for restoring the DB, they should check back in automatically. How long has it been since you restored and are they still showing offline? Are any at all checking in?

You can push a new sylink to a client following the link in my first post.

Once they check in, they grab any new updates

When you run the Management Configuration Wizard, did you attached the latest Server Private Key??

 

Regards,

JM

Have you perform DR method

Symantec Endpoint Protection 12.1: Best Practices for Disaster Recovery with the Symantec Endpoint Protection Manager

http://www.symantec.com/business/support/index?page=content&id=TECH160736

Hi

Please check whether you have restored correct Server Private Key

Regards

 

Thanks all for your feedback , Brain yes at present clients are showing online in SEPM right now , currently the two major issues :

1.Window update definations is not upto date there is a difference in symantec and manager as follows

Latest from Symantec: 04/09/2014 r23
Latest on Manager: 04/01/2014 r23

Please suggest how to fix this issues because clients are also don't have the latest updates.

2.Currently java is not installed and SEPM console is not showing Home Tab so please sugest which version of java should I install my SEPM ver is 12.1.4013.4013 , previously I have issue with the version after updating to JRE 7u45 and higher I am not getting the console Tab properly.

For your reference I am attaching the screenshots.

Regards

Geekgadget

 

can you try manually updating the jdb file on manager.

SEPM installs JRE, did you upgrade or manually uninstalled?

 

It was upgrade automatically after that I am getting issue with SEPM console so I uninstalled the JRE 7u+ ver

and I have tried to fix this issue by installing JRE 6u45 , 6u31 but it didn't fix the console issue.

logoff the SEPM console session and close it. Then try to stop the services of SEPM for a few minutes then start it again. Log-in to console and see what will happens..

 

Regards

JM

I have tried these options already but it doesn't fix the issue.

1.Window update definations is not upto date there is a difference in symantec and manager as follows

Latest from Symantec: 04/09/2014 r23
Latest on Manager: 04/01/2014 r23

Symantec Endpoint Protection Manager 12.1 is not updating 32-bit or 64-bit virus definitions due to corrupt content

Article:TECH166923

|

Created: 2011-08-10

|

Updated: 2013-06-20

|

Article URL http://www.symantec.com/docs/TECH166923

 

2.Currently java is not installed and SEPM console is not showing Home Tab so please sugest which version of java should I install my SEPM ver is 12.1.4013.4013 , previously I have issue with the version after updating to JRE 7u45 and higher I am not getting the console Tab properly.

 

Open SEPM console using the address; https://servername:9090 and installed java version.

After installing Java I am getting Error of Apache Http Error.

Please check the Printscreen of Server and Client.

 

Regards

Geekgadget

What setting sgowing in when click of change setting TAB ?

System is unresponsive due to SemSvc.exe once Symantec Endpoint Protection Manager is upgraded to 12.1

Article:TECH168248

|

Created: 2011-08-26

|

Updated: 2012-02-29

|

Article URL http://www.symantec.com/docs/TECH168248

Hi ,

I had restore the database successfully and clients are communicating with SEPM but the issue that I am facing currently is that reports are not generating properly

I have run the scan and update the content but in reports the events are showing for the 31 March 2014 the date on which I select the database to restore.

It means that Logs are not coming properly please guide me how to fix this issue.

 

Regards

Geekgadget

How much disk space available ?Does all client showing online in SEPm console ?

do you see any latest entry, If yes then its a problem with client not sending data to sepm or SEPM not processing the data from client

http://www.symantec.com/business/support/index?page=content&id=TECH141236

Hi James007,

Currently I have 224 GB of Disk space on C drive and there is communication in between SEPM and the client and getting the virus defination update.

Please check the screen shot attached but I don't understand why Logs are not coming.

Regards

Geekgadget

Does yo have find any .err files or tmp files & Dat files ?

Browse to \Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\agentinfo

Yes we have these files kindly check the PS.

Regards

Geekgadget

Clients cannot send data back to Symantec Endpoint Protection Manager

Article:TECH105348

|

Created: 2008-01-09

|

Updated: 2009-01-30

|

Article URL http://www.symantec.com/docs/TECH105348

Symantec Endpoint Protection Manager does not parse client forwarded logs in a timely manner.

Article:TECH91835

|

Created: 2009-01-14

|

Updated: 2009-01-14

|

Article URL http://www.symantec.com/docs/TECH91835

Also Try this

Fixed so that LiveUpdate restarts after the client computer recovers from standby.

2)1. Browse to \Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\agentinfo

2. Look for any .err files or tmp files & Dat files

3. If you find anything which is not processed by sepm then it might be the reason for the client data loss

4. Stop SEPM services from services.msc

5. Delete all the files inside the location \Program Files\Symantec\Symantec Endpoint Protection Manager\data\inbox\agentinfo

6. Restart the SEPM services.

Check the SEPM now if still issue persist go for step 7

 

7. Run the Management server configuration wizard.

Thanks James for your support I will try this and update you.

Regards

Geekgadget

Hi geekgadget,

Did you need more help here ?

Hi James ,

I have tried the options that you mentioned above to fix this issue but it didn't work in my case so as you mentioned to run the mgmt server wizard again I will go try that one probably after 1 week due to involvement in some other work.

I will let you know the result as soon as I try it.

 

Regards

Geekgadget

Hi James,

Issue has been fixed now the Logs are coming into the SEPM successfully but one thing that I am notice is that after fixing this issue I push the upgrade client with package on all clients located in diffrent Groups.

Events ocurred in following manner.

1.Initally 996 Clients are showing up but after "Upgrade Client with package" client count come down to around 550.

2.The count increase and at present 705 clients are shown up.

3.But the number of Out of date client increases exponentially to 252.

4.My License is about to expire today.

Please just how to fix this issue.

 

Regards

Geekgadget

Out of date client are online ?

 

Yes the clients are online , the out of date client list include also the IP address of SEPM server itself and other clients are also online but they are showing out of date.

What may be the reason for this please suggest.

 

 

Does you have check some of client manually it's update or not ?

 

What is the communication setting for these clients?

Run the update content from SEPM on client groups.

Restart the SEPM Database service.

Try to clear he defintion

How to clear out definitions for a Symantec Endpoint Protection 12.1 client manually

Article:HOWTO59193

|

Created: 2011-09-08

|

Updated: 2013-06-24

|

Article URL http://www.symantec.com/docs/HOWTO59193

Yes When I manually run Live update on the cleint their are getting the updates from the Symantec.

Have you restart the database service?

James Yes I have restarted Database service / SEPM and after that restart the server itself but it doesn't fix the issue.

As today is the last day of license expiry will this thing is related and one things I want to know that I have push the "push the upgrade client with package" for 32 bit OS can I revert this back which will help to fix the issue.

Regards

Geekgadget.

As today is the last day of license expiry will this thing is related and one things I want to know that I have push the "push the upgrade client with package" for 32 bit OS can I revert this back which will help to fix the issue.

No it's not releated for SEPM license expiry.

 

You can enable sylink debugging

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

Article:TECH104758

|

Created: 2008-01-18

|

Updated: 2013-02-26

|

Article URL http://www.symantec.com/docs/TECH104758

What is the heartbeat interval and communication setting?

James I tried to change the registry values after disabling the Tampter protection on one client and update the content from server as well client side but please check the print screen change cannot be done alothough I have login with the Admin account and I also tried this after SMC -STOP but it also not help.

 

 

After enable sylink debugging you can wait 2 or 3 heartbeat setting and post the Sylink.log.

Does any GUP server available between sep and SEPM server ?If gup client available does GUP client updated ?

As I have given the Print screen above I have tried to edit the registry before & after running SMC symantec services but I gives error and not allowed to change the registry values.

You need to disabled tamper protect after you can change registry value.

I have also done that.

Does new policy has applied that client ?

Yes I have update the policy from SEPM End and from client Machine I will try this one more time and let you know.

 

 

Should be tamper protection... update the policy ,, verify the serial number you should be good to edit

Did you need more help here ?

Hello, 

From client sonsole are you able to connect the SEPM ? check the connecion status and check the poicy serial numbers.

Regards

Ajin

Thanks all for the support now the issue has been resolved but one thing is that old logs are not recovered and as you can see from the current SEPM console the numbers of cleaned/  blocked are decreased from around 1.3 lakhs to 22000 approx after so I thinks that logs are lost after the restoration of SEPM  is there any way to recover the lost logs and sorry for the late reply.

For the future strategy I am thinking if I create one syslog server and divert the logs to that server then in this case will the logs remain on both SEPM and Syslog server? or only on Syslog server actually my intention are to take the back of SEPM logs so that in case of any issue we have a backup copy of all Logs.

Please share any document in which restoration of Logs back to SEPM from Syslog server is given it will be a great support for me in the future.

Thanks again for all for their support and help

Regards

Geekgadget

Log data is not backed up unless you configure Symantec Endpoint Protection Manager to back it up. If you do not back up the logs, then only your log configuration options are saved during a backup. You can use the backup to restore your database, but the logs in the database are empty of data when they are restored. Backing up the database and logs Article:HOWTO55107|Created: 2011-06-29|Updated: 2011-12-16|Article URL http://www.symantec.com /docs/HOWTO55107

Backing up the database and logs

Article:HOWTO55107

|

Created: 2011-06-29

|

Updated: 2011-12-16

|

Article URL http://www.symantec.com/docs/HOWTO55107

While I did not recieve Apache errors as originally cited, I wanted to add my solution to this thread.

Our primary database which SEP utilizes abruptly went offline and after a SQL restore (not using SEPM), the clients continued to show as "Offline" even after remotely deploying Sylink files to try and correct the problem.

The fix I found was rather basic- Our SEPM server was very low on disk space (around 130MB).  After adding sufficient capacity and rebooting, clients began reporting within minutes.