Endpoint Protection

   Hi all,

  We are using Symantec Endpoint Protection Manager 12.1 (RU2) installed on Windows Server 2003.

 Two days ago we started to receive message "Database is down". We've checked the server and found (like few times before) that there is no more space left on the disk because of the sep5.log who become to big. Like previously, we deleted the log file, restarted "Symantec Embedded Database" service, but this time nothing happened (usually sem5.log is automatically created) . We've tried to start the service manually few times, restarted whole server, but without success, service remained stoped. We checked Application log and found that "SQLANYs_sem5" error is generated whenever we try to start  "Symantec Embedded Database" service. We've manualy created sem5.log file, but after starting the service file was automatically removed.

 Please help me resolve this issue.

 Thanks in advance.

hello,

Please provide below details..

How many disk space available in drive ?

could you provide sem5.log ?

Look this same issue discussion

https://www-secure.symantec.com/connect/forums/symantec-embedded-database-services-not-starting

The below article provides the instructions for forcing the recreation of the transaction log:
http://www.symantec.com/docs/TECH178718

Note, the command remains the same from SEP12.1RU1 to SEP12.1RU2

 After we deleted sem5.log file (that's why i cannot  provide logs), we have more then 30GB space.

Hi,

Try the following steps

The following steps have been shown to resolve this issue. Note that these steps assume the default installation directories for the SEPM:

1) Stop Symantec Endpoint Protection Manager Service.

2) Navigate to C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db\ within Windows Explorer.

3) Locate the sem5.log and rename it to sem5.log.old

4)Open a command prompt  and navigate to the following location: C:\Program Files\Symantec\Symantec Endpoint Protection Manager\ASA\win32

5)Issue the following command: dbsrv11 -f "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db\sem5.db

6) Start the Symantec Embedded Database & Manager service through the service control manager (services.msc).

Hi Agreed with above Chetan comments,

Please follow above comments you will be able to login.

Cause:

Possible cause is that SEPM was processing the traffic logs when it was unexpectedly shutdown and unable to complete the transaction after the restart .
Solution

Follow below steps to resolve issue

   1. Go to "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db\" and rename sem5.log to sem5.log.old
   2. Click Start, click on Run and Type “CMD” then click OK
   3. In the Command Prompt type: "CD C:\Program Files\Symantec\Symantec Endpoint Protection Manager\ASA\win32\" and press Enter this will change directories to the folder containing dbsrv9.exe.
   4. Force the recreation of sem5.log. Type: "dbsrv9 -f "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db\sem5.db" and press Enter
   5. Click Start, click on Run and Type “services.msc” then click OK and start the Symantec Embedded Database Service
   6. Start the Symantec Endpoint Protection Manager service.
   7. If it stays started then go ahead and log into the Symantec Endpoint Protection Manager and everything should now be working properly
   8. If the Symantec Endpoint Protection Manager service fails to start then run Management Server Configration Wizard in order to log in to the Symantec Endpoint Protection Manager
 

Just to clarify, dbsrv9 is the db engine used in SEP11.  SEP12.1 uses the dbsrv11.exe executable as described in the article I provided in my earlier post.

As you've already deleted the sem.log file, you can jump straight down to step 6 of the article where you run the "dbsrv11 -f" command.

On a different note, the article I posted states that issues with the sem5.log file growing especially large were meant to have been resolved in SEP12.1RU1MP1.

As you're now on SEP12.1RU2, can you check your DB maintenance settings and ensure truncation is enabled?  If the logs are filling up so quickly that the default "Every 4 hours" truncate job is insufficient to keep the sem5.log file at a manageable size, then consider increaing the frequency of the task (perhaps every 2 hours).

If you wish to verify if SEPM's attempt to truncate is failing, then you may wish to run the steps in the below article the next time the log starts to get large

http://www.symantec.com/docs/TECH171546

This runs a truncate outside of SEPM, to help you troubleshoot one of the possible reasons the log is so large.

Hi

Please repair the SEPM

Regards

 Like many times in the past, this forum has proved to be very useful. :) Thanks Chetan (and all the others) for your help.""dbsrv12 -f..." command resolved the problem (not as it was mentioned "dbsrv11 -f"). 

Thanks for the update.