Symantec Management Platform (Notification Server)

HI All,

we are facing an issue in our setup... recently we have observed huge traffic was getting generated from NS to one of our Remote Site, So our network team blocked the communication between the server and remote site as it was effecting the Production. Later after 3 days we have unblocked the communication from NS to remote site... but since then we are not able receive events/posts from those remote clients. none of the agent is able to post the event to NS and not able to send the basic inventory. below are the Errors in Client Log  file:

<event date="Nov 03 14:54:35" severity="2" hostName="XXXX" source="CoNetworkTransport(384)"module="AexNetComms.dll"Process="AexNSAgent.exe" pid="1016" thread="1308" tickCoutn="76570656"><![CDATA[HTTP error: [-2147209951]]]></event>

<event date="Nov 03 14:54:35" severity="2" hostName="XXXX" source="CoNetworkTransport(384)"module="AexNetComms.dll"Process="AexNSAgent.exe" pid="1016" thread="1308" tickCoutn="76570656"><![CDATA[(PostFile to http://Servername/Altiris/NS/Agent/PostEvent.aspx' failed: HTTP error: [-2147209951]]]></event>

If you can Remote Desktop into a client machine in the remote site, try to hit the URL listed in the Log warnings in IE: http://servername/Altiris/NS/Agent/PostEvent.aspx .

If you see a 503 or  500 error, there is likely a problem on the NS

If you see a Page cannot be displayed message, then there is a routing / connectivity issue causing http/80 traffic to be blocked

If you see a 403 error, then there is some kind of virtual directory permissions issue.

Are any of your other NS Clients affected?

Hi Rion,

I have tried that too... I have tried to post the events manually from the client machine and i was getting NO Data Message on the web page. I read that its a valid message.

Any thing else i should try with...

Regards,

naresh

The errors Rion is looking for will be listed at the end of your post in the IIS logs.  200 is good, everything else we want to look up.  Just do a search for PostEvent.aspx in the logs and see what the result was.

Hate to say this, but is it possible one of the routers is going bad?  Things like this can happen with a bad port on a router.  You might try getting a laptop from the remote site and bring it local to see if the problem magically "goes away" when it's not longer running over that hop.  We saw a router once block any file with a certain extension - literally.  You could transfer a TXT file fine, change the extension, and bam - it'd be blocked by the router.  Pulled the cable from that port and moved to another port - problem gone, so I KNOW this kind of thing can happen.  Since you say it's all one site, and since before that this same site was bringing the NS down, we have to consider something site-specific.

You might also check any policy sent to that site, or agent versions at that site, or PS/TS at that site - that kind of thing - to see what is unique.  GPO's?

That might be some help.