Endpoint Protection

 View Only
Back to discussions
Expand all | Collapse all

Clients don`t report to SEPM.

Migration User

Migration UserJun 09, 2010 07:20 AM

Hi Please check the ODBC connection if it is fine.
Migration User

Migration UserJun 09, 2010 08:09 AM

I Use AD OU in SEPM and cannot do this :(
Migration User

Migration UserJun 09, 2010 08:19 AM

Are you using images for re imaging the PCs?
Migration User

Migration UserJun 10, 2010 05:46 AM

Using regedit :)
Migration User

Migration UserJun 10, 2010 06:09 AM

Yes you have to use regedit...
Migration User

Migration UserJun 10, 2010 06:20 AM

AravindKM This is not resolve problem in my case
Migration User

Migration UserJun 10, 2010 07:58 AM

How? Other group is AD Integrated/
Migration User

Migration UserJun 10, 2010 08:50 AM

Not helped.
Migration User

Migration UserJun 11, 2010 12:05 AM

No i not have users.
Migration User

Migration UserJun 11, 2010 09:44 AM

Try by restarting smc service in the client....
Migration User

Migration UserJun 12, 2010 05:14 AM

No result.
Migration User

Migration UserJun 21, 2010 06:50 AM

Any answers?

  • 1.  Clients don`t report to SEPM.

    Posted Jun 09, 2010 07:11 AM

    Hello!

    I Have 1 SEPM 11 ru6r2 installed on windows 2003 ee sp2 r2.
    Half of clients don`t send status to SEPM. From problematic client i can telnet to SEP server, i can see "OK" if i try to open secars URL.
    Installing of a new server did not resolve. Client who could send status report to old server is still sending, (sylinkreplacer.exe used for migrate to new server) but who couldn't send status report is still have some problems. The problem is being solved when i reinstall sep client (uninstall and install him again). If i install over existing sep client without uninstalling some problem is still remain.
    Pls help to invistigate.
    Thx.


  • 2.  RE: Clients don`t report to SEPM.

    Posted Jun 09, 2010 07:20 AM
    Hi

    Please check the ODBC connection if it is fine.


  • 3.  RE: Clients don`t report to SEPM.

    Posted Jun 09, 2010 07:22 AM
    Take a copy of SerDef.dat and sylink.xml from a working PC.It will be under C:\Program Files\Symantec\Symantec Endpoint Protection folder.Move these original files along with its backup files from the problematic client(You have to stop smc service by using smc -stop command before doing this.)Put the new files in problematic pc in C:\Program Files\Symantec\Symantec Endpoint Protection then start SMC service(smc -start command).


  • 4.  RE: Clients don`t report to SEPM.

    Posted Jun 09, 2010 07:58 AM
    Thx for quick reply.
    Warrior6945

    On SEPM server ODBC work fine without any error.
    AravindKM

    I tryed, but him still remain this error.


  • 5.  RE: Clients don`t report to SEPM.

    Posted Jun 09, 2010 08:01 AM
    Delete that client from SEPM console and restart smc service in the client....


  • 6.  RE: Clients don`t report to SEPM.

    Posted Jun 09, 2010 08:09 AM
    I Use AD OU in SEPM and cannot do this :(


  • 7.  RE: Clients don`t report to SEPM.

    Posted Jun 09, 2010 08:19 AM
    Are you using images for re imaging the PCs?


  • 8.  RE: Clients don`t report to SEPM.

    Posted Jun 09, 2010 08:38 AM
     Not to all, we use ghost to deploy images, but we have promblem on both type of installation (manual, and ghost deploy)


  • 9.  RE: Clients don`t report to SEPM.

    Posted Jun 09, 2010 09:06 AM
    Delete %programfiles%\Common Files\Symantec Shared\HWID\sephwid.xml
    Open the registry and navigate to HKLM\Software\Symantec\Symantec Endpoint Protection\SMC\Sylink\Sylnk
    Edit the "HardwareID" value data to be blank
    Restart the Symantec Management Client (SMC) service in the services snap-in.
    Do this also along with the suggestions in my earlier post...


  • 10.  RE: Clients don`t report to SEPM.

    Broadcom Employee
    Posted Jun 09, 2010 12:10 PM
    post the sylink logs over here, while client tries to get the policy ( manually update the policy) from SEPM


  • 11.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 02:30 AM

    After i delete Hardware id and file, client is up on PC (i can see green dot), but  it is shown as offline in SEPM.

    .

    This is log after manual update from SEPM (computer who comes online in SEPM):


    06/10 10:00:19 [2076] <MaintainPushConnection:>SMS return=200
    06/10 10:00:19 [2076] <ParseHTTPStatusCode:>200=>200 OK
    06/10 10:00:19 [2076] <MaintainPushConnection:>RECEIVE STAGE COMPLETED
    06/10 10:00:19 [2076] <MaintainPushConnection:>COMPLETED
    06/10 10:00:19 [2076] <ScheduleNextUpdate>Manually assigned heartbeat=5 seconds
    06/10 10:00:19 [2076] HEARTBEAT: Check Point 8
    06/10 10:00:19 [2076] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
    06/10 10:00:19 [2076] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
    06/10 10:00:19 [2076] <IndexHeartbeatProc>====== IndexHeartbeat Procedure stops at 10:00:19 ======
    06/10 10:00:19 [2076] <IndexHeartbeatProc>Set Heartbeat Result= 2
    06/10 10:00:19 [2076] <IndexHeartbeatProc>Sylink Comm.Flags: 'Connection Failed' = 0, 'Using Backup Sylink' = 0, 'Using Location Config' = 0
    06/10 10:00:19 [2076] Use new configuration
    06/10 10:00:19 [2076] HEARTBEAT: Check Point Complete
    06/10 10:00:19 [2076] <IndexHeartbeatProc>Done, Heartbeat=5seconds
    06/10 10:00:19 [2076] </CSyLink::IndexHeartbeatProc()>
    06/10 10:00:19 [2076] <CheckHeartbeatTimer>====== Heartbeat loop stops at 10:00:19 ======
    06/10 10:00:24 [2076] <CheckHeartbeatTimer>====== Heartbeat loop starts at 10:00:24 ======
    06/10 10:00:25 [2076] <GetOnlineNicInfo>:Netport Count=1
    06/10 10:00:25 [2076] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="10.0.113.150" Mac="00-14-38-10-8a-99" Gateway="10.0.113.254" SubnetMask="255.255.255.0"/></SSANICs>
    06/10 10:00:25 [2076] <CalcAgentHashKey>:CH=7EEFF1680A008BA700D290F24F4BDCFF1computer.company.com3B0D60EAE7E574CA9214976BA4002833
    06/10 10:00:25 [2076] <CalcAgentHashKey>:CHKey=D268FC39D6007AA2F1D57FE96EEBA5F3
    06/10 10:00:25 [2076] <CalcAgentHashKey>:C=7EEFF1680A008BA700D290F24F4BDCFF1computer.company.com
    06/10 10:00:25 [2076] <CalcAgentHashKey>:CKey=754467B037903E5772FBCCE6580A7BE7
    06/10 10:00:25 [2076] <CalcAgentHashKey>:UCH=7EEFF1680A008BA700D290F24F4BDCFF0username.company.com.COMcomputername.company.com3B0D60EAE7E574CA9214976BA4002833
    06/10 10:00:25 [2076] <CalcAgentHashKey>:UCHKey=CBA81A6B99FBBDAD442EF925729C2EDA
    06/10 10:00:25 [2076] <CalcAgentHashKey>:UC=7EEFF1680A008BA700D290F24F4BDCFF0username.company.COMcomputername.company.com
    06/10 10:00:25 [2076] <CalcAgentHashKey>:UCKey=AE28B42AADCF53FBEE9DD40F4A021306
    06/10 10:00:25 [2076] <DoHeartbeat>HardwareID=3B0D60EAE7E574CA9214976BA4002833
    06/10 10:00:25 [2076] <DoHeartbeat>CHKey=D268FC39D6007AA2F1D57FE96EEBA5F3
    06/10 10:00:25 [2076] <DoHeartbeat>CKey=754467B037903E5772FBCCE6580A7BE7
    06/10 10:00:25 [2076] <DoHeartbeat>UCHKey=CBA81A6B99FBBDAD442EF925729C2EDA
    06/10 10:00:25 [2076] <DoHeartbeat>UCKey=AE28B42AADCF53FBEE9DD40F4A021306
    06/10 10:00:25 [2076] <DoHeartbeat> Set heartbeat event
    06/10 10:00:25 [2076] Use new configuration
    06/10 10:00:25 [2076] <CSyLink::IndexHeartbeatProc()>
    06/10 10:00:25 [2076] <IndexHeartbeatProc> Got ConfigObject to proceed the operation.. pSylinkConfig: 01C53C28
    06/10 10:00:25 [2076] <IndexHeartbeatProc>====== Reg Heartbeat loop starts at 10:00:25 ======
    06/10 10:00:25 [2076] HEARTBEAT: Check Point 1
    06/10 10:00:25 [2076] Get First Server!
    06/10 10:00:25 [2076] HEARTBEAT: Check Point 2
    06/10 10:00:25 [2076] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
    06/10 10:00:25 [2076] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
    06/10 10:00:25 [2076] HEARTBEAT: Check Point 3
    06/10 10:00:25 [2076] <IndexHeartbeatProc>Setting the session timeout on Profile Session to 30000
    06/10 10:00:25 [2076] HEARTBEAT: Check Point 4
    06/10 10:00:25 [2076] <IndexHeartbeatProc>===Get Index STAGE===
    06/10 10:00:25 [2076] ************CSN=83703
    06/10 10:00:25 [2076] <mfn_MakeGetIndexUrl:>Request is: action=12&hostid=E52887460A008BA7017EE3E572382209&chk=D268FC39D6007AA2F1D57FE96EEBA5F3&ck=754467B037903E5772FBCCE6580A7BE7&uchk=CBA81A6B99FBBDAD442EF925729C2EDA&uck=AE28B42AADCF53FBEE9DD40F4A021306&hid=3B0D60EAE7E574CA9214976BA4002833&groupid=7EEFF1680A008BA700D290F24F4BDCFF&mode=0&hbt=300&as=83703&cn=[hex]4C4147412D3030314C&lun=[hex]6C616B616D72616E&udn=[hex]415A455243454C4C2E434F4D
    06/10 10:00:25 [2076] <GetIndexFileRequest:>http://10.0.139.167:8014/secars/secars.dll?h=E90D20E9624523FBFD247AFF4ED0F74A07E5415784028DA37CDFAAA23E1E355B397D13D323BF3CA223EB12412799B2006B83DD40C777A75C70006BCE2A37A8E2F6E292BE70B789C6BB26355F41C38E52B550157909F2E88F0A79BC0CFDE8C89DBAD685AC5DD279944E8B335E2695B67075A47C2DF5098DAB4784F08635B482AC44A12AEC46FA249E0C56FBF940BD975F979A7BB10215B64FBB1B3623A24B144213E1995D0FAC678FD39B8A7D2BF8EB14E44FFA9B6EAD5CB20176659A05DE7C6F2AC87FF69537377E75B528126C13A0BF1E56EFB22C50E181BD51089507140E81EB7A0DE2214FEF7D5E1C2A05CEA6F930425E26C299ED8ABD41C872D0D100B8FAFEDA4378AE38B778CA982BFC97E480535BC3E0F75D76F0ED179309D1D38F6421CE292DA4984569B7816C3896CEA3EDE1EE0BB0367B764DDE399B557A1E4F019029D691CCCF3EA28D4E07A74F503859D69FE108A9C59E4591050C09BCB9097EC9BCCF0472CD50F5246DB994223C904FCD7F3CE3D945D627EC6002D00DD63646AD802C8696A23445CB7A783EB0AB1F8217
    06/10 10:00:25 [2076] <GetIndexFileRequest:>SMS return=200
    06/10 10:00:25 [2076] <ParseHTTPStatusCode:>200=>200 OK
    06/10 10:00:25 [2076] <FindHeader>Sem-HashKey:=>D268FC39D6007AA2F1D57FE96EEBA5F3
    06/10 10:00:25 [2076] <GetIndexFileRequest:>Loading the current mode:1
    06/10 10:00:25 [2076] <FindHeader>Sem-LANSensor:=>0
    06/10 10:00:25 [2076] <FindHeader>Sem-Signatue:=>52E17E90EFD755CD2B63E56A86A917442BC91C48A205AAA38F3D2BF321424D07EE6B633DE8D3ED2FA2131B52E8B08A3A427795E6D579D3AF1E6F7C9D23BABB9F070D1F663AF81B723F6825C81F30BB77FD011A13908F984EF6DDF97C7B93F21FA069BA5EE3062C7DF7F2C9AB17AC5506601F74EBC49D4FDAE044D04299FAF8E3
    06/10 10:00:25 [2076] <FindHeader>Sem-CommandGUID:=>FAC66EB70A00649E002350252B036D7B
    06/10 10:00:25 [2076] <mfn_DoGetIndexFile200>Content Lenght => 1171
    06/10 10:00:25 [2076] SignIf::VerifySignature(data, dataLen, sig, sigLen) => Verification Successful..
    06/10 10:00:25 [2076] <mfn_DoGetIndexFile200>Index File: <?xml version="1.0" encoding="UTF-8" ?><GroupIndex SiteID="D72C8C300A008BA70023A1876087F917" ServerID="889919A20A008BA701CC5D5A14E2137C" GroupID="11C3D6710A008BA700FC5408B97813BF" GroupCheckSum="842CEA790A323210858413531" LastModifiedTime = "10/06/2010 08:46:00"> <Profile Checksum="C93944845D844E2FE35A46A7C52E7560" SerialNumber="11C3-05/17/2010 09:56:54 823" LastModifiedTime="08/06/2010  09:42:09"/> <ConfigFile Checksum="F760A8BE0D3723BEB1B64A4D4B8BD3C4" LastModifiedTime="08/06/2010  09:42:09"/> <IDSFile Checksum="703A0AE1B8EC84B36CDBAECB7E800283" LastModifiedTime="08/06/2010  09:42:09"/> <SylinkFile Checksum="4F30DF5DFC52ACD0A3718558C5FB965B" LastModifiedTime="08/06/2010  09:42:09"/> <LSProfile Checksum="1051C7A6CA04A685D28D6951E6146223" SerialNumber ="11C3-05/17/2010 09:56:54 823" LastModifiedTime ="08/06/2010  09:42:09"/>
     <LiveUpdate>
      <File Checksum="128792D64B2193872F22D5312D173A54" DeltaFlag="1" FullSize="898265" LastModifiedTime="1276141524249" Moniker="{42B17E5E-4E9D-4157-88CB-966FB4985928}" Seq="100605001"/>
       <File Checksum="CE6E6B5068FD0014AB289F6DA1DAA0C2" DeltaFlag="1" FullSize="81254651" LastModifiedTime="1276126989768" Moniker="{C60DC234-65F9-4674-94AE-62158EFCA433}" Seq="100609022"/>
       <File Checksum="869CD275F6EF57002241696CDE09C5E0" DeltaFlag="1" FullSize="82880698" LastModifiedTime="1276126934094" Moniker="{1CD85198-26C6-4bac-8C72-5D34B025DE35}" Seq="100609022"/>
       <File Checksum="E640EFB8ADE153C60290CE1CA132ECD3" DeltaFlag="1" FullSize="879643" LastModifiedTime="1276126893672" Moniker="{D3769926-05B7-4ad1-9DCF-23051EEE78E3}" Seq="100605001"/>
       <File Checksum="12FD39F0AAC7338BA4BA0A1889C489D6" DeltaFlag="1" FullSize="669829" LastModifiedTime="1273844908660" Moniker="{C25CEA47-63E5-447b-8D95-C79CAE13FF79}" Seq="80929016"/>
       <File Checksum="6AF23D3DB2B679E479A115CA9DFBFF91" DeltaFlag="1" FullSize="650307" LastModifiedTime="1273844915082" Moniker="{ECCC5006-EF61-4c99-829A-417B6C6AD963}" Seq="2008021700"/>
       <File Checksum="DE7723ED00B2C3E106FD9E7E475FCA48" DeltaFlag="1" FullSize="6487" LastModifiedTime="1273844960755" Moniker="{4F889C4A-784D-40de-8539-6A29BAA43139}" Seq="91111048"/>
       <File Checksum="0C36413AB4221EF8D229BC04F8DA3D02" DeltaFlag="1" FullSize="76805" LastModifiedTime="1276112381841" Moniker="{CC40C428-1830-44ef-B8B2-920A0B761793}" Seq="100609018"/>
       <File Checksum="86F0F98A7FF96DE701F0C857E23958B9" DeltaFlag="1" FullSize="1155207" LastModifiedTime="1276112382638" Moniker="{812CD25E-1049-4086-9DDD-A4FAE649FBDF}" Seq="100609018"/>
       <File Checksum="0AD20386F5721235AA8BDC17B71D84CC" DeltaFlag="1" FullSize="1155232" LastModifiedTime="1276112384201" Moniker="{E1A6B4FF-6873-4200-B6F6-04C13BF38CF3}" Seq="100609018"/>
       <File Checksum="BB29A825D29B1CB934FDD4B1112AF634" DeltaFlag="1" FullSize="76787" LastModifiedTime="1276112384842" Moniker="{E5A3EBEE-D580-421e-86DF-54C0B3739522}" Seq="100609018"/>
     </LiveUpdate>
    </GroupIndex>
    06/10 10:00:25 [2076] <GetIndexFileRequest:>RECEIVE STAGE COMPLETED
    06/10 10:00:25 [2076] <GetIndexFileRequest:><Command> Before post command event, ID: FAC66EB70A00649E002350252B036D7B
    06/10 10:00:25 [2076] <PostEvent>going to post event=EVENT_SYLINK_QUERY_COMMANDIDS
    06/10 10:00:25 [2076] <PostEvent>done post event=EVENT_SYLINK_QUERY_COMMANDIDS, return=0
    06/10 10:00:25 [2076] <GetIndexFileRequest:><Command> After post command event, ID: FAC66EB70A00649E002350252B036D7B
    06/10 10:00:25 [2076] ************CSN=83704
    06/10 10:00:25 [2076] <mfn_MakeGetCommandFileUrl:>Request is: action=10&hostid=E52887460A008BA7017EE3E572382209&chk=D268FC39D6007AA2F1D57FE96EEBA5F3&ck=754467B037903E5772FBCCE6580A7BE7&uchk=CBA81A6B99FBBDAD442EF925729C2EDA&uck=AE28B42AADCF53FBEE9DD40F4A021306&groupid=7EEFF1680A008BA700D290F24F4BDCFF&fn=[hex]46414336364542373041303036343945303032333530323532423033364437422E646178&hid=3B0D60EAE7E574CA9214976BA4002833&as=83704&cdn=[hex]4C4147412D3030314C&lun=[hex]6C616B616D72616E&udn=[hex]415A455243454C4C2E434F4D
    06/10 10:00:25 [2076] <GetCommandFileRequest:>http://10.0.139.167:8014/secars/secars.dll?h=32A866343085EBF7A45A46D3AD66AAE507E5415784028DA37CDFAAA23E1E355B397D13D323BF3CA223EB12412799B2006B83DD40C777A75C70006BCE2A37A8E2F6E292BE70B789C6BB26355F41C38E52B550157909F2E88F0A79BC0CFDE8C89DBAD685AC5DD279944E8B335E2695B67075A47C2DF5098DAB4784F08635B482AC44A12AEC46FA249E0C56FBF940BD975F979A7BB10215B64FBB1B3623A24B144213E1995D0FAC678FD39B8A7D2BF8EB14E44FFA9B6EAD5CB20176659A05DE7C6FA8CB650AE9C6F88A1D1613938719A75981FD00A10FC19227EF128A998318D413882B6E02CE892877BC1ECDB899F0205C29D68EED0830B693A353B02E850E300832A71AA67A88A019AF34BD601B3E328E4989A4D707E1DEFC45A1A8A76F4328E5E969EA4C82D0D43D5D1C39EAF4EAEA18AABDA5674B1D55D2FCDE90316D116214FBBE039722198E3922A23F7BB9F4E548ACDBA7DFC100CD51F4FEF7CE99039686FE3139A420F1808D306935C609988D06F2CB194D9CB08AFFF638861651407F373D7AAECD666A9FBD5553CAE6807B6ABA79C3C472109D0FBE82DC1A10CED031B818F2FAB65439D00B5D455FE4AE59A500EB7A5E4B203C84359FC9BA4338758504094B73CED01DF4AEE4DAD9E7F2E09DBF
    06/10 10:00:25 [2076] <GetCommandFileRequest:>SMS return=200
    06/10 10:00:25 [2076] <ParseHTTPStatusCode:>200=>200 OK
    06/10 10:00:25 [2076] <FindHeader>Sem-Signatue:=>9B540C6A9DBB2EABBF9B79775E9D53A2AC1A33A5D41EC39E130388FECAA5B4C7B1CC4CF294FA67652C537E576F890E807AFAEB80BE9499081EB148F8822C1AFBB8B0B00EAF585D2AB82C8FC62B1BA7991C40C722811006DF9160BF9B8E083B920D2DD7EE537A43A325EB918548D0FC0BA35B29D4CEA7691F0337691FB29CD801
    06/10 10:00:25 [2076] <mfn_DoGetCOMMANDFile200>Content Lenght => 308
    06/10 10:00:25 [2076] <mfn_DoGetCOMMANDFile200>Got COMMAND file from server, read bytes=308
    06/10 10:00:25 [2076] SignIf::VerifySignature(data, dataLen, sig, sigLen) => Verification Successful..
    06/10 10:00:25 [2076] <mfn_SentCommandContentToAgent>content len is 308
    06/10 10:00:25 [2076] <mfn_SentCommandContentToAgent>----------Checksum: 0629FCDCA7EACAC6CBBBBB37503A8CBF
    06/10 10:00:25 [2076] <mfn_SentCommandContentToAgent>----------New content: <?xml version="1.0" encoding="UTF-8"?>
    <Command Description="Update content for selected computers in group &quot;OS=XP&quot;" Feature="LU" Id="FAC66EB70A00649E002350252B036D7B" Name="Update_Now" NameSpace="schema" SeqNumber="1276146016579" _d="false" _i="5B37A5420A00649E00B87D31FDDE4425" _t="1276146016579" _v="8"/>

    06/10 10:00:25 [2076] <PostEvent>going to post event=EVENT_SYLINK_ADD_COMMAND
    06/10 10:00:26 [2076] <PostEvent>done post event=EVENT_SYLINK_ADD_COMMAND, return=0
    06/10 10:00:26 [2076] <mfn_SentCommandContentToAgent>========== Received command file from server completed. =========
    06/10 10:00:26 [2076] <mfn_SentCommandContentToAgent>completed
    06/10 10:00:26 [2076] <PostEvent>going to post event=EVENT_SERVER_ONLINE
    06/10 10:00:26 [2076] <PostEvent>done post event=EVENT_SERVER_ONLINE, return=0
    06/10 10:00:26 [2076] <mfn_DoGetCOMMANDFile200>completed
    06/10 10:00:26 [2076] <GetCommandFileRequest:>RECEIVE STAGE COMPLETED
    06/10 10:00:26 [2076] <GetCommandFileRequest:>COMPLETED
    06/10 10:00:26 [2076] <PostEvent>going to post event=EVENT_SYLINK_PROCESS_COMMANDS
    06/10 10:00:26 [2076] <PostEvent>done post event=EVENT_SYLINK_PROCESS_COMMANDS, return=0
    06/10 10:00:26 [2076] <GetIndexFileRequest:>COMPLETED
    06/10 10:00:26 [2076] <IndexHeartbeatProc>GetIndexFile handling status: 0
    06/10 10:00:26 [2076] <IndexHeartbeatProc>Switch Server flag=0
    06/10 10:00:26 [2076] HEARTBEAT: Check Point 5.1
    06/10 10:00:26 [2076] <IsInClientIPorOnLink> NextHop Not equal 10.0.139.167,return FALSE
    06/10 10:00:26 [2076] <IsInClientIPorOnLink> NextHop is OnLink with 10.0.113.150,return TRUE
    06/10 10:00:26 [2076] <mfn_GetOutIP> Next Hop IP is a local IP or ONLINK:10.0.113.150
    06/10 10:00:26 [2076] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    06/10 10:00:26 [2076] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    06/10 10:00:26 [2076] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {42B17E5E-4E9D-4157-88CB-966FB4985928} Seq:100605001
    06/10 10:00:26 [2076] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    06/10 10:00:27 [2076] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {1CD85198-26C6-4bac-8C72-5D34B025DE35} Seq:100609022
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    06/10 10:00:27 [2076] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {CC40C428-1830-44ef-B8B2-920A0B761793} Seq:100609018
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    06/10 10:00:27 [2076] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {E1A6B4FF-6873-4200-B6F6-04C13BF38CF3} Seq:100609018
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_SERVER_ONLINE
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_SERVER_ONLINE, return=0
    06/10 10:00:27 [2076] <ScheduleNextUpdate>Reset Heartbeat factor index, hearbeat=300 seconds
    06/10 10:00:27 [2076] HEARTBEAT: Check Point 6
    06/10 10:00:27 [2076] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: AVMan
    06/10 10:00:27 [2076] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: GUP
    06/10 10:00:27 [2076] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: LUMan
    06/10 10:00:27 [2076] <mfn_PostAgentInfo>===REQUESTING CMC OP-STATE ===
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_SERVER_REQUIRES_CLIENT_SESTATE
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_SERVER_REQUIRES_CLIENT_SESTATE, return=0
    06/10 10:00:27 [2076] ReasonDescForFailure*** = Host Integrity check is disabled.
    06/10 10:00:27 [2076] ReasonDescForFailure*** = Host Integrity check is disabled.
    06/10 10:00:27 [2076] *** = <SSAInfo NameSpace="rpc" AgentID="E52887460A008BA7017EE3E572382209" ComputerID="00078B1D0A008BA7017EE3E5E532DFB3" HardwareKey="3B0D60EAE7E574CA9214976BA4002833" GroupID="11C3D6710A008BA700FC5408B97813BF">
    <AgentHIInfo Status="3" ReasonCode="105" ReasonDescForFailure="Host Integrity check is disabled."/>
    <SSAHostInfo>
    <NetworkIdentity UserDomain="COMPANY.COM" LogonUser="lakamran" HostDomain="company.com" HostName="LAGA-001L" HostDesc="GapAydinKO"/>
    <SSAProduct Version="11.0.6005.562"/>
    <SSAOS Version="5.1.2600" Desc="Windows XP Professional " Type="17105154" ServicePack="Service Pack 3" Language="9"/>
    <Processor ProcessorType="x86 Family 6 Model 13 Stepping 8" ProcessorClock="1862" ProcessorNum="1"/>
    <Memory Size="536199168"/>
    <Disk Letter="C:\" Size="21474721792"/>
    <BIOS Version="HP     - 28040520"/>
    <TpmDevice Id="0"/>
    <SSAProfile Version="5.0.0" SerialNumber="11C3-05/17/2010 09:56:54 823"/>
    <SSAIDS Version="" SerialNumber=""/>
    <Deuce Signature="100605001"/>
    <SSAUTC Bias="-240"/>
    <DNSs><DNS Address="10.0.135.2"/><DNS Address="10.0.135.3"/></DNSs>
    <SSANICs><SSANIC Ip="10.0.113.150" Mac="00-14-38-10-8a-99" Gateway="10.0.113.254" SubnetMask="255.255.255.0"/></SSANICs><Firewall OnOff="1" Installed="1"/>
    </SSAHostInfo>
    <RebootRequired Status="0"></RebootRequired>
    <InstalledFeatures><Feature Id ="256"/></InstalledFeatures>
    </SSAInfo>
    06/10 10:00:27 [2076] <mfn_PostAgentInfo>Volatile op-state damper: 0, Interval passed: 109
    06/10 10:00:27 [2076] <mfn_PostAgentInfo>Free memory difference: 12840960, Threshold: 15480420
    06/10 10:00:27 [2076] <mfn_PostAgentInfo>Free disk space difference: 16719872, Threshold: 308911710
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_SYLINK_QUERY_COMMANDSTATUS
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_SYLINK_QUERY_COMMANDSTATUS, return=0
    06/10 10:00:27 [2076] <mfn_PostAgentInfo><?xml version='1.0' encoding='UTF-8' ?>
    <SESAgentOpState AgentID="E52887460A008BA7017EE3E572382209" Timestamp="1276146027244"><CommandStatus Version="1.0" HardwareKey="3B0D60EAE7E574CA9214976BA4002833"><Data><![CDATA[FAC66EB70A00649E002350252B036D7B`-11644473600000`1276146026150`1`0``0`0`Update_Now
    ]]></Data></CommandStatus></SESAgentOpState>
    06/10 10:00:27 [2076] ************CSN=83705
    06/10 10:00:27 [2076] <mfn_MakePostUrl:>Request is: action=192&hostid=E52887460A008BA7017EE3E572382209&chk=D268FC39D6007AA2F1D57FE96EEBA5F3&ck=754467B037903E5772FBCCE6580A7BE7&uchk=CBA81A6B99FBBDAD442EF925729C2EDA&uck=AE28B42AADCF53FBEE9DD40F4A021306&as=83705&cn=[hex]4C4147412D3030314C&lun=[hex]6C616B616D72616E&udn=[hex]415A455243454C4C2E434F4D
    06/10 10:00:27 [2076] <mfn_PostAgentInfo>http://10.0.139.167:8014/secars/secars.dll?h=07D917617ABA6EAE9BA977D19F158D3D372E4803EDAF3FF647FBB4100224B2BF5F1532E2DE59ACCC074B0A4F47547765B6252776D1D5AA69B49A5257C21098620D7DA9AA97E5B2148B85E73937884E2D48F9D271F7ECF22183A1BEB79792B1F90A7A50E25F81B19F35A3C9EB9755613BFA7ACCE803BF4BBD22B040F04AC7AE15A0F1FF7E880F22918F6AE7B8297CC63A5F319DCFD0FE3904ECEBDF2E596482DE211A4DF59D8539B9C9D290FE3A7C42EA57BD50BDB6C5AAA28E0F1D6842538A3DD8B0779F388249016F8BC3999B8265CEBA3032CE1281A961BAF33965DBB68544F40A9A9EB187AAEB19C55A52B08ECF4F186B41D99894C100F536BAC415FCF4294D4384D0CDD99AC22CCDD27989247F7C5E72AFD91F0AA39C245AB7298910871D28155B081148DD89AA742D87FEEE3926
    06/10 10:00:27 [2076] <mfn_PostAgentInfo>POST the total size=292
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_SYLINK_UPLOAD_COMMANDSTATUS_DONE
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_SYLINK_UPLOAD_COMMANDSTATUS_DONE, return=0
    06/10 10:00:27 [2076] <mfn_PostAgentInfo>Done with return code = 200
    06/10 10:00:27 [2076] <IndexHeartbeatProc>===UPLOAD STAGE===
    06/10 10:00:27 [2076] <PostEvent>going to post event=EVENT_SERVER_READY_TO_UPLOAD_EVENT_LOG
    06/10 10:00:27 [2076] <PostEvent>done post event=EVENT_SERVER_READY_TO_UPLOAD_EVENT_LOG, return=0
    06/10 10:00:27 [2076] <IndexHeartbeatProc>===PREPARE EVENT LOG STAGE===
    06/10 10:00:27 [2076] <PrepareEventLog>initialized technology extension processing ok
    06/10 10:00:27 [2076] <PrepareEventLog>Allow total logs to send=0
    06/10 10:00:27 [2076] <IndexHeartbeatProc>Communication Mode=0(Push Mode)
    06/10 10:00:27 [2076] <IndexHeartbeatProc>Enter Push Session
    06/10 10:00:27 [2076] <IndexHeartbeatProc>Setting the session timeout on Profile Session (for MaintainPushConnection) to 320000
    06/10 10:00:27 [2076] <MaintainPushConnection:>Push Connecton!
    06/10 10:00:28 [2076] ************CSN=83706
    06/10 10:00:28 [2076] <mfn_MakeGetPushUrl:>Request is: action=128&hostid=E52887460A008BA7017EE3E572382209&chk=D268FC39D6007AA2F1D57FE96EEBA5F3&ck=754467B037903E5772FBCCE6580A7BE7&uchk=CBA81A6B99FBBDAD442EF925729C2EDA&uck=AE28B42AADCF53FBEE9DD40F4A021306&groupid=7EEFF1680A008BA700D290F24F4BDCFF&mode=0&as=83706
    06/10 10:00:28 [2076] <MaintainPushConnection:>http://10.0.139.167:8014/secars/secars.dll?h=F3C4E3EBAB34397384072F33B49302EC372E4803EDAF3FF647FBB4100224B2BF5F1532E2DE59ACCC074B0A4F47547765B6252776D1D5AA69B49A5257C21098620D7DA9AA97E5B2148B85E73937884E2D48F9D271F7ECF22183A1BEB79792B1F90A7A50E25F81B19F35A3C9EB9755613BFA7ACCE803BF4BBD22B040F04AC7AE15A0F1FF7E880F22918F6AE7B8297CC63A5F319DCFD0FE3904ECEBDF2E596482DE211A4DF59D8539B9C9D290FE3A7C42EA57BD50BDB6C5AAA28E0F1D6842538A3DDF273BB3694BD5161A305593274A5B53BCF389F05669B4FF93FF370F3EDEDA9E33FEC39FF3DCC810FEDC8ED052934FB34D73977DF9A51506B08FB748FC5B8FC9C2FB3013AF9913AA79421BC3D3978872
     


  • 12.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 02:33 AM
    Can you check whether these clients are appearng in the default group?
    Can you do a search in SEPM console?


  • 13.  RE: Clients don`t report to SEPM.

    Broadcom Employee
    Posted Jun 10, 2010 02:54 AM
    how did you delete the Hardware id from the client. If there are duplicate clients it might show up the issue.

    delete the client entry from SEPM as well. restart the smc service on client and see if it turns out to be green dot on SEPM as well?


  • 14.  RE: Clients don`t report to SEPM.

    Broadcom Employee
    Posted Jun 10, 2010 05:37 AM
    delete the client from SEPM

    After i delete Hardware id and file ---> how did you delete H/W ID? from registry?, im not sure about the script, select * from sem_computer to know the hardware_key! when you export it to excel and sort you will get a counts of the H/W ID.


  • 15.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 05:45 AM
     Yes computer located in default group, but not report status on SEPM,


    Pete, i try to find duplicate in sem_computer tables but without result. clients do not have duplicated hardware id in DB (only computer which i delete hardware id in registry).


  • 16.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 05:46 AM
     Using regedit :)


  • 17.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 06:09 AM
    Yes you have to use regedit...


  • 18.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 06:20 AM
    AravindKM

    This is not  resolve problem in my case


  • 19.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 06:46 AM
    Open ersecreg.log file which is present in \Program Files \Symantec\Symantec Endpoint Protection Manager\data\inbox\log and see whether your problematic clients are appearing there?If it is appearing paste those lines here....


  • 20.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 07:11 AM
    05/14 18:46:04 [3392:3180] 4 Bad format.
    05/14 18:46:04 [3392:3180] 10.0.139.167--FAILED
    05/14 18:46:05 [3392:1660] 4 Bad format.
    05/14 18:46:05 [3392:1660] 10.0.139.167--FAILED
    05/14 18:47:39 [3392:1660] 4 Bad format.
    05/14 18:47:39 [3392:1660] 10.0.139.167--FAILED
    05/14 18:47:40 [3392:3180] 4 Bad format.
    05/14 18:47:40 [3392:3180] 10.0.139.167--FAILED05/14 18:46:04 [3392:3180] secreg initailized. Kcs=B038F57EBD2869D8ADC6935F2444A451


    06/10 14:28:02 [2308:2372] 10.0.113.150<AgentInfo DomainID="7EEFF1680A008BA700D290F24F4BDCFF" AgentType="105" UserDomain="COMPANY" LoginUser="USERNAME" ComputerDomain="company.com" ComputerName="Computername" PreferredGroup="My%20Company%5cDefault%20Group" PreferredMode="1" HardwareKey="68F9A9DF84571F1926C12A44977290A0" SiteDomainName=""/> AgentID=B06B7F6D0A008BA7004FDF114A8D19E5

    06/10 14:39:01 [2308:2368] 10.0.113.150<AgentInfo DomainID="7EEFF1680A008BA700D290F24F4BDCFF" AgentType="105" UserDomain="COMPANY" LoginUser="USERNAME" ComputerDomain="company.com" ComputerName="computername" PreferredGroup="My%20Company%5cDefault%20Group" PreferredMode="1" HardwareKey="68F9A9DF84571F1926C12A44977290A0" SiteDomainName=""/> AgentID=B06B7F6D0A008BA7004FDF114A8D19E5


  • 21.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 07:34 AM
    Your clients sits in default group.You can move it from default group to proper group....


  • 22.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 07:58 AM
    How? Other group is AD Integrated/


  • 23.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 08:09 AM
    Try by re syncing with AD.If not helps delete  OU and re-import it....


  • 24.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 08:50 AM
     Not helped.


  • 25.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 08:53 AM
    Are you able to see still the clients in default group?...


  • 26.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 09:12 AM
    Yes may be this because this client have duplicated hardware id in DB?


  • 27.  RE: Clients don`t report to SEPM.

    Posted Jun 10, 2010 09:41 AM
    Using "Find Users" instead of "Find Computers" see example below:



    If found, does the User have a Green Dot next to it?

    -Mike


  • 28.  RE: Clients don`t report to SEPM.

    Posted Jun 11, 2010 12:05 AM
    No i not have users.


  • 29.  RE: Clients don`t report to SEPM.

    Posted Jun 11, 2010 12:52 AM
    to remove the duplicate entries in the SEPM database:
    http://127.0.0.1:9090/servlet/ConsoleServlet?ActionType=ConfigServer&action=CleanClients
    Ref:remove the duplicate entries


  • 30.  RE: Clients don`t report to SEPM.

    Posted Jun 11, 2010 06:56 AM
    I try to open this URL, but duplicate ID exist in DB.


  • 31.  RE: Clients don`t report to SEPM.

    Posted Jun 11, 2010 07:47 AM
    That url has to run n the IE of SEPM...If you run like that are you getting any error?


  • 32.  RE: Clients don`t report to SEPM.

    Posted Jun 11, 2010 08:00 AM

    <?xml version="1.0" encoding="UTF-8" ?>

    <Response ResponseCode="0" />



    without any error


  • 33.  RE: Clients don`t report to SEPM.

    Posted Jun 11, 2010 08:08 AM
    After this are you able to see your clients in default group with green dot?


  • 34.  RE: Clients don`t report to SEPM.

    Posted Jun 11, 2010 09:37 AM
     I moved client to other AD and resync SEPM with AD, The computer has got in correct ou, but he don`t report


  • 35.  RE: Clients don`t report to SEPM.

    Posted Jun 11, 2010 09:44 AM
    Try by restarting smc service in the client....


  • 36.  RE: Clients don`t report to SEPM.

    Posted Jun 12, 2010 05:14 AM
    No result.


  • 37.  RE: Clients don`t report to SEPM.

    Posted Jun 21, 2010 06:50 AM
    Any answers?


  • 38.  RE: Clients don`t report to SEPM.

    Posted Jun 21, 2010 06:54 AM
    From default group delete the client and restart the smc service of the client.....