Endpoint Protection

Hello,

I would like to ask you what could be a reason of event viewer error 7203 for Symantec Endpoint Protection  Manager? We faced this error only twice since years but it happened last Monday (14th of September). Server tried to install latest definition 150913001 and 150913024 but both installation failed. I talk about SEPM installation not deployment new revision on the clients. Reassuming, we had all machines not up to date for one day. When new revision appear (150914002) all back to normal. Maybe 13th September revisions could be corrupted? Here is log from event viewer:

Info:Content install failed on the server.
Product:Virus and Spyware definitions Win32 12.1 RU6
Version:MicroDefsB.CurDefs
Language:SymAllLanguages
Monikers:{535CB6A4-441F-4e8a-A897-804CD859100E},{D2EE983B-0AB4-F6D4-00BE-1539CD0C259E}
Sequence:150913024
PublishDate:09-13-2015
Revision:24
Source:Public LiveUpdate Server (Symantec LiveUpdate Server)
Size(in bytes):748446247

 

Info:Content install failed on the server.
Product:Virus and Spyware definitions Win32 12.1 RU6
Version:MicroDefsB.CurDefs
Language:SymAllLanguages
Monikers:{535CB6A4-441F-4e8a-A897-804CD859100E},{D2EE983B-0AB4-F6D4-00BE-1539CD0C259E}
Sequence:150913001
PublishDate:09-13-2015
Revision:1
Source:Public LiveUpdate Server (Symantec LiveUpdate Server)
Size(in bytes):750244247

 

 

If you run the symhelp tool it will show you if content is corrupt. Please try that first. What's your SEPM version?

Hello,

Our SEPM version is 12.1.6168.6000.

Running symhelp.exe on SEP Manager only error or warnings below appear. Nothing regarding definitions. 

regards

Although it is flagging c: drive disk space on that symhelp. Have you tried increasing available space and seeing if that resolves the issue? Temp location it downloads the definitons to is C: drive (hard coded) it needs about 3 times the space 1 to download 2 to extract then 3 to distribute. Once that's done it moves the files to location of the SEPM depending on how many content revisions you are using will determine space used at the SEPM location. 

so here is what I guess would have happened. may be while processing the definition on 13th server might have been really low on disk space and that might have forced the live update from not getting updated. later the resources would have become free, which might have paved way for the definitions to get updated. If you still need more convincing answer i would suggest you to post the sesmlu.log, again please be reminded if the logging isn't a FINEST level we may not be able to find the actual cause.

I can't confirm this unfortunately. I forget mentioned that we have Manager application installed on D:/ drive (we have ther more than 300GB free). Symhelp tool detect low disc space on C:/. We have also set monitoring of disc space available and for sure C:/ partition did not have too low free space, because we did not recieve any alerts.

I was wondering if definition downloaded by our manager could be corrupted?

Actuallty, I can't see any definitions from 13th of September in Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\content and here Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\inbox\content\incoming

 

regards

well as you say there is a slight chance that the downloaded definition may be corrupt and that caused the sepm to not to process it.

no matter where you install the SEPM the live update client will download the definition to the O/S drive in your case it will be C drive. 

 

but to be sure we need logs to confirm the same.  

Thanks for answer. So if we hadn't got FINEST logging set, explanation of this issue is imposible?

more or less the answer is yes.

Good Day,

I am looking for the below file: 

Can someone help?

I am not sure what this file is user for, you should probably call the symantec support to obtain the files.

With what product? What does this file do?

Symantec

 

I want to unistall this plug-in on MAC

Yes, but, for Symantec Endpoint Protection? If so then see this:

Uninstalling the Symantec Endpoint Protection client for Mac

File : (symantec-auth-client-plugin-uninstall.dmg)

Definitely not for SEP.

Closest I found was here:

http://www.symantec.com/docs/HOWTO93679

You may want to try the Deployment Solution forum

https://www-secure.symantec.com/connect/endpoint-management/forums/deployment-solution