Endpoint Protection

 View Only

  • 1.  Endpoint Clients don't report their status to the management Console. But they are connected.

    Posted Dec 17, 2009 10:43 AM
    Hi
    At first sorry for my english (i'm french).

    I have Symantec Endpoint 11 MR5. Since one week i have a weird issue.

    The Endpoint Console  shows that my clients have an old version of their antivirus database. But when i check my clients they have the last and good version of the database.
    Second point: When i run a command in my console for clients (like restart computer), the console told me the command was not received by the client. But my client restart ...

    All clients are connected to the Endpoint Server and the Endpoint Console see clients connected too.

    I give you the SylinkMonitor log.

    12/17 15:12:51 [3632] <ScheduleNextUpdate>Manually assigned heartbeat=1 seconds
    12/17 15:12:51 [7860] AH: (InetWaiting) urgent exit event on InetCtrlBlock: 0000000003E26140
    12/17 15:12:51 [7860] Throw Internet Exception, Error Code=997;AH: failed to send request...
    12/17 15:12:51 [7860] <MaintainPushConnection:>COMPLETED
    12/17 15:12:51 [7860] <ScheduleNextUpdate>new scheduled heartbeat=32 seconds
    12/17 15:12:51 [7860] HEARTBEAT: Check Point 8
    12/17 15:12:51 [7860] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
    12/17 15:12:51 [7860] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
    12/17 15:12:51 [7860] <IndexHeartbeatProc>====== IndexHeartbeat Procedure stops at 15:12:51 ======
    12/17 15:12:51 [7860] <IndexHeartbeatProc>Set Heartbeat Result= 2
    12/17 15:12:51 [7860] <IndexHeartbeatProc>Sylink Comm.Flags: 'Connection Failed' = 0, 'Using Backup Sylink' = 0, 'Using Location Config' = 0
    12/17 15:12:51 [7860] Use new configuration
    12/17 15:12:51 [7860] HEARTBEAT: Check Point Complete
    12/17 15:12:51 [7860] <IndexHeartbeatProc>Done, Heartbeat=32seconds
    12/17 15:12:51 [7860] </CSyLink::IndexHeartbeatProc()>
    12/17 15:12:51 [7860] <CheckHeartbeatTimer>====== Heartbeat loop stops at 15:12:51 ======
    12/17 15:13:21 [3520] <CExpBackoff::CExpBackoff()>
    12/17 15:13:21 [3520] </CExpBackoff::CExpBackoff()>
    12/17 15:13:23 [7576] <CSyLink::mfn_DownloadNow()>
    12/17 15:13:23 [7576] </CSyLink::mfn_DownloadNow()>
    12/17 15:13:23 [7860] <CheckHeartbeatTimer>====== Heartbeat loop starts at 15:13:23 ======
    12/17 15:13:24 [7860] <GetOnlineNicInfo>:Netport Count=4
    12/17 15:13:24 [7860] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="172.20.0.100" Mac="00-21-70-fa-d3-92" Gateway="172.20.1.254" SubnetMask="255.255.254.0"/><SSANIC Ip="192.168.18.1" Mac="00-50-56-c0-00-01" Gateway="0.0.0.0" SubnetMask="255.255.255.0"/><SSANIC Ip="192.168.91.1" Mac="00-50-56-c0-00-08" Gateway="0.0.0.0" SubnetMask="255.255.255.0"/><SSANIC Ip="192.168.56.1" Mac="08-00-27-00-a8-aa" Gateway="0.0.0.0" SubnetMask="255.255.255.0"/></SSANICs>
    12/17 15:13:24 [7860] <CalcAgentHashKey>:CH=60921551AC14011E00DD89F99DE7C3451DE-L-CXYHB4Jsea.localD713B9C43CAF71CC432D1564E2BE0465
    12/17 15:13:24 [7860] <CalcAgentHashKey>:CHKey=7508CE2C96ACE4E11F5BF942879B6A2C
    12/17 15:13:24 [7860] <CalcAgentHashKey>:C=60921551AC14011E00DD89F99DE7C3451DE-L-CXYHB4Jsea.local
    12/17 15:13:24 [7860] <CalcAgentHashKey>:CKey=65F17674A2862F0679C5FCBB9FF0DC1E
    12/17 15:13:24 [7860] <CalcAgentHashKey>:UCH=60921551AC14011E00DD89F99DE7C3450vtaupenasSEA.LOCALDE-L-CXYHB4Jsea.localD713B9C43CAF71CC432D1564E2BE0465
    12/17 15:13:24 [7860] <CalcAgentHashKey>:UCHKey=E443E24602AC52BA34C6F0D12C86BF48
    12/17 15:13:24 [7860] <CalcAgentHashKey>:UC=60921551AC14011E00DD89F99DE7C3450vtaupenasSEA.LOCALDE-L-CXYHB4Jsea.local
    12/17 15:13:24 [7860] <CalcAgentHashKey>:UCKey=981616E93E186BDCD9BC6F756281F7F0
    12/17 15:13:24 [7860] <DoHeartbeat>HardwareID=D713B9C43CAF71CC432D1564E2BE0465
    12/17 15:13:24 [7860] <DoHeartbeat>CHKey=7508CE2C96ACE4E11F5BF942879B6A2C
    12/17 15:13:24 [7860] <DoHeartbeat>CKey=65F17674A2862F0679C5FCBB9FF0DC1E
    12/17 15:13:24 [7860] <DoHeartbeat>UCHKey=E443E24602AC52BA34C6F0D12C86BF48
    12/17 15:13:24 [7860] <DoHeartbeat>UCKey=981616E93E186BDCD9BC6F756281F7F0
    12/17 15:13:24 [7860] <DoHeartbeat> Set heartbeat event
    12/17 15:13:24 [7860] Use new configuration
    12/17 15:13:24 [7860] <CSyLink::IndexHeartbeatProc()>
    12/17 15:13:24 [7860] <IndexHeartbeatProc> Got ConfigObject to proceed the operation.. pSylinkConfig: 0000000003E5EED0
    12/17 15:13:24 [7860] <IndexHeartbeatProc>====== Reg Heartbeat loop starts at 15:13:24 ======
    12/17 15:13:24 [7860] HEARTBEAT: Check Point 1
    12/17 15:13:24 [7860] Get First Server!
    12/17 15:13:24 [7860] HEARTBEAT: Check Point 2
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
    12/17 15:13:24 [7860] HEARTBEAT: Check Point 3
    12/17 15:13:24 [7860] <IndexHeartbeatProc>Setting the session timeout on Profile Session to 30000
    12/17 15:13:24 [7860] HEARTBEAT: Check Point 4
    12/17 15:13:24 [7860] <IndexHeartbeatProc>===Get Index STAGE===
    12/17 15:13:24 [7860] ************CSN=2234
    12/17 15:13:24 [7860] <mfn_MakeGetIndexUrl:>Request is: action=12&hostid=66520723AC14011E00B49B19786A07B1&chk=7508CE2C96ACE4E11F5BF942879B6A2C&ck=65F17674A2862F0679C5FCBB9FF0DC1E&uchk=E443E24602AC52BA34C6F0D12C86BF48&uck=981616E93E186BDCD9BC6F756281F7F0&hid=D713B9C43CAF71CC432D1564E2BE0465&groupid=60921551AC14011E00DD89F99DE7C345&mode=0&hbt=300&as=2234&cn=[hex]44452D4C2D4358594842344A&lun=[hex]7674617570656E6173&udn=[hex]5345412E4C4F43414C
    12/17 15:13:24 [7860] <GetIndexFileRequest:>http://172.20.1.30:8014/secars/secars.dll?h=3ECF391D70652ECBC37F50E4870BF3A2C3D65A8C6CAC8C7BE47B22719C20535E394BE569DB4D3E61B864CEFA49609351381044DDC72DEB711736FCBF41C177EA7311F4BF3244C0ECEA1D66D12CB505A45C7B052C09BB81A84E33AB05A2E8A8E9E948F1C6DD2DF22022824CB9A3EF1E9F6B488DB90D7392B2869543852B2F172B0A081E78665786A80BC54BE0932C1FB58F74F595119EB46B28DC346D8D9D50B3B88B858DD3C6A2D351C8234F2A2688A59C93A1135541F2EB3E08F85919A5C8B507336D5DC2E0CE9B136165DF836A9FCB00AB83C5EADF014E9B6EABE55B4324BB71DB338EFBA75895C3D3B3281D34C02F24506A49BFB3AB5A49ADC69B8569487D877E98E657C3708848DDBB83F71AEECEC20C02BB82674D04737A9094F316BC17D49185F859AE69A80FC4F48BFEDE3266E10D4F140DE5C03174D2B4653B34B9F73AFF7DA2F29843A17D72E1BE8CD9BD59C5B70D4D5DF7DA4418182A9338E1D1E10EF7558814A6B3EDA8F8C640E58234A2E10FDD299921FDE3BFEC6D370E2CDE6023746B939D6D51147C28BA4D3AFCFDC3
    12/17 15:13:24 [7860] <GetIndexFileRequest:>SMS return=200
    12/17 15:13:24 [7860] <ParseHTTPStatusCode:>200=>200 OK
    12/17 15:13:24 [7860] <FindHeader>Sem-HashKey:=>E443E24602AC52BA34C6F0D12C86BF48
    12/17 15:13:24 [7860] <FindHeader>Sem-LANSensor:=>0
    12/17 15:13:24 [7860] <FindHeader>Sem-Signatue:=>4EDBC3E425D89E5E7534346EBCB6C8A26013E60708AE8DB0396D916FD7E96796E1CFCD00F1B3F47FBCAAA92F73580B05A9F20F17B862FE0149678CD264FE9C1B5004CD1C0D812E818EE3F891D3330ADA1713FDBA7672E9206738C36B70AB5D7DB79705424C5136CF0BFAF31317B58B3A466B620A09A9DBB04F9F321457ED8F7E
    12/17 15:13:24 [7860] <mfn_DoGetIndexFile200>Content Lenght => 1348
    12/17 15:13:24 [7860] SignIf::VerifySignature(data, dataLen, sig, sigLen) => Verification Successful..
    12/17 15:13:24 [7860] <mfn_DoGetIndexFile200>Index File: <?xml version="1.0" encoding="UTF-8" ?><GroupIndex SiteID="4F4208ECAC14011E0181B10D556705F7" ServerID="CD87E603AC14011E002F0BC1F7F279B7" GroupID="C8C50B53AC14011E00C26CAB4C7B8AC3" GroupCheckSum="842CEA790A323210858413531" LastModifiedTime = "17/12/2009 14:50:53">    <Profile Checksum="5D5D7176408440B54B97864D1501E649" SerialNumber="C8C5-12/17/2009 11:18:31 113" LastModifiedTime="17/12/2009  14:50:53"/>    <ConfigFile Checksum="E9C5C17C6FA93DEF68F702ABDC2CE5BC" LastModifiedTime="17/12/2009  14:50:53"/>    <IDSFile Checksum="703A0AE1B8EC84B36CDBAECB7E800283" LastModifiedTime="17/12/2009  14:50:53"/>    <SylinkFile Checksum="CCF857C2A211A633FA0A0254625ED4B0" LastModifiedTime="17/12/2009  14:50:53"/>    <LSProfile Checksum="C9B1934B063F485403B99A7BCFF8E81F" SerialNumber ="C8C5-12/17/2009 11:18:31 113" LastModifiedTime ="17/12/2009  14:50:53"/>
        <LiveUpdate>
            <File Checksum="C094305F3A4134609BDF7DD1B6C98529" DeltaFlag="1" FullSize="65369725" LastModifiedTime="1261045614373" Moniker="{C60DC234-65F9-4674-94AE-62158EFCA433}" Seq="91216052"/>
             <File Checksum="81E03046452A4DCAB6A4F9EAA2B92D48" DeltaFlag="1" FullSize="65561015" LastModifiedTime="1261045532547" Moniker="{1CD85198-26C6-4bac-8C72-5D34B025DE35}" Seq="91216052"/>
             <File Checksum="DD1F76B082B0AFDB9799D3DC779EEC84" DeltaFlag="1" FullSize="1336438" LastModifiedTime="1260580786085" Moniker="{42B17E5E-4E9D-4157-88CB-966FB4985928}" Seq="91209006"/>
             <File Checksum="10164252FAE8C4F702D6EBBFE3BD6BF9" DeltaFlag="1" FullSize="1320204" LastModifiedTime="1260580783767" Moniker="{D3769926-05B7-4ad1-9DCF-23051EEE78E3}" Seq="91209007"/>
             <File Checksum="A1141EC785568A889B6937B42E0FD28F" DeltaFlag="1" FullSize="669829" LastModifiedTime="1252940919563" Moniker="{C25CEA47-63E5-447b-8D95-C79CAE13FF79}" Seq="80929016"/>
             <File Checksum="A7A4E94BC6D70C843A301C21197DA678" DeltaFlag="1" FullSize="650307" LastModifiedTime="1252940926282" Moniker="{ECCC5006-EF61-4c99-829A-417B6C6AD963}" Seq="2008021700"/>
             <File Checksum="2177A8CF1A54442E017305AA7EE36300" DeltaFlag="1" FullSize="88188" LastModifiedTime="1252940981034" Moniker="{EA960B33-2196-4d53-8AC4-D5043A5B6F9B}" Seq="80820001"/>
             <File Checksum="8F557FE956C05D647720788736D76B5E" DeltaFlag="1" FullSize="1662247" LastModifiedTime="1252940986706" Moniker="{DB206823-FFD2-440a-9B89-CCFD45F3F1CD}" Seq="80820001"/>
             <File Checksum="92C95A60C8A8CD374801778F27D7A6ED" DeltaFlag="1" FullSize="1419193" LastModifiedTime="1252940996347" Moniker="{C13726A9-8DF7-4583-9B39-105B7EBD55E2}" Seq="80820001"/>
             <File Checksum="658900E48A6AA161EDF9D4B1134ECC46" DeltaFlag="1" FullSize="6487" LastModifiedTime="1258006847768" Moniker="{4F889C4A-784D-40de-8539-6A29BAA43139}" Seq="91111048"/>
             <File Checksum="524D4E4F75668339A376BE4544923D4E" DeltaFlag="1" FullSize="76805" LastModifiedTime="1260980520341" Moniker="{CC40C428-1830-44ef-B8B2-920A0B761793}" Seq="91216016"/>
             <File Checksum="52CF1EB4DDEFA5CE0A94B48AF824D72F" DeltaFlag="1" FullSize="744765" LastModifiedTime="1260980521487" Moniker="{812CD25E-1049-4086-9DDD-A4FAE649FBDF}" Seq="91216016"/>
             <File Checksum="EEC5958A3025A4DCE72070D72FFFE193" DeltaFlag="1" FullSize="744796" LastModifiedTime="1260980538975" Moniker="{E1A6B4FF-6873-4200-B6F6-04C13BF38CF3}" Seq="91216016"/>
             <File Checksum="34FF28C713E2383A7EB98026E9B93269" DeltaFlag="1" FullSize="76793" LastModifiedTime="1260980552758" Moniker="{E5A3EBEE-D580-421e-86DF-54C0B3739522}" Seq="91216016"/>
        </LiveUpdate>
    </GroupIndex>
    12/17 15:13:24 [7860] <GetIndexFileRequest:>RECEIVE STAGE COMPLETED
    12/17 15:13:24 [7860] <GetIndexFileRequest:>COMPLETED
    12/17 15:13:24 [7860] <IndexHeartbeatProc>GetIndexFile handling status: 0
    12/17 15:13:24 [7860] <IndexHeartbeatProc>Switch Server flag=0
    12/17 15:13:24 [7860] HEARTBEAT: Check Point 5.1
    12/17 15:13:24 [7860] <IsInClientIPorOnLink> NextHop is OnLink with 172.20.0.100,return TRUE
    12/17 15:13:24 [7860] <mfn_GetOutIP> Out IP is:172.20.0.100
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    12/17 15:13:24 [7860] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {C60DC234-65F9-4674-94AE-62158EFCA433} Seq:91216052
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    12/17 15:13:24 [7860] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {D3769926-05B7-4ad1-9DCF-23051EEE78E3} Seq:91209007
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    12/17 15:13:24 [7860] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {C13726A9-8DF7-4583-9B39-105B7EBD55E2} Seq:80820001
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    12/17 15:13:24 [7860] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {812CD25E-1049-4086-9DDD-A4FAE649FBDF} Seq:91216016
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    12/17 15:13:24 [7860] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {E5A3EBEE-D580-421e-86DF-54C0B3739522} Seq:91216016
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_SERVER_ONLINE
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_SERVER_ONLINE, return=0
    12/17 15:13:24 [7860] <ScheduleNextUpdate>Reset Heartbeat factor index, hearbeat=300 seconds
    12/17 15:13:24 [7860] HEARTBEAT: Check Point 6
    12/17 15:13:24 [7860] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: AVMan
    12/17 15:13:24 [7860] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: GUP
    12/17 15:13:24 [7860] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: LUMan
    12/17 15:13:24 [7860] <mfn_PostAgentInfo>===REQUESTING CMC OP-STATE ===
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_SERVER_REQUIRES_CLIENT_SESTATE
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_SERVER_REQUIRES_CLIENT_SESTATE, return=0
    12/17 15:13:24 [7860] ReasonDescForFailure*** = La vérification de l'intégrité de l'hôte est désactivée.
    12/17 15:13:24 [7860] ReasonDescForFailure*** = La vérification de l'intégrité de l'hôte est désactivée.
    12/17 15:13:24 [7860] *** = <SSAInfo NameSpace="rpc" AgentID="66520723AC14011E00B49B19786A07B1" ComputerID="14E44C0AAC14011E00B49B1906102DD9" HardwareKey="D713B9C43CAF71CC432D1564E2BE0465" GroupID="C8C50B53AC14011E00C26CAB4C7B8AC3">
    <AgentHIInfo Status="3" ReasonCode="105" ReasonDescForFailure="La vérification de l'intégrité de l'hôte est désactivée."/>
    <SSAHostInfo>
    <NetworkIdentity UserDomain="SEA.LOCAL" LogonUser="vtaupenas" HostDomain="sea.local" HostName="DE-L-CXYHB4J" HostDesc=""/>
    <SSAProduct Version="11.0.5002.333"/>
    <SSAOS Version="6.1.7600" Desc="Windows 7 Enterprise Edition" Type="17170690" ServicePack="" Language="12"/>
    <Processor ProcessorType="Intel64 Family 6 Model 23 Stepping 10" ProcessorClock="2660" ProcessorNum="2"/>
    <Memory Size="4244549632"/>
    <Disk Letter="C:\" Size="61208522752"/>
    <BIOS Version="DELL   - 27d90911"/>
    <TpmDevice Id="0"/>
    <SSAProfile Version="5.0.0" SerialNumber="C8C5-12/17/2009 11:18:31 113"/>
    <SSAIDS Version="" SerialNumber=""/>
    <Deuce Signature="91209006"/>
    <SSAUTC Bias="-60"/>
    <DNSs><DNS Address="172.20.1.31"/><DNS Address="172.20.1.32"/></DNSs>
    <WINSs><WINS Address="172.20.1.33"/><WINS Address="172.20.1.34"/></WINSs>
    <DHCPServer Address="172.20.1.33"/><SSANICs><SSANIC Ip="172.20.0.100" Mac="00-21-70-fa-d3-92" Gateway="172.20.1.254" SubnetMask="255.255.254.0"/><SSANIC Ip="192.168.18.1" Mac="00-50-56-c0-00-01" Gateway="0.0.0.0" SubnetMask="255.255.255.0"/><SSANIC Ip="192.168.91.1" Mac="00-50-56-c0-00-08" Gateway="0.0.0.0" SubnetMask="255.255.255.0"/><SSANIC Ip="192.168.56.1" Mac="08-00-27-00-a8-aa" Gateway="0.0.0.0" SubnetMask="255.255.255.0"/></SSANICs><Firewall OnOff="1" Installed="1"/>
    </SSAHostInfo>
    <RebootRequired Status="0"></RebootRequired>
    <InstalledFeatures><Feature Id ="256"/></InstalledFeatures>
    </SSAInfo>

    12/17 15:13:24 [7860] <mfn_PostAgentInfo>Volatile op-state damper: 0, Interval passed: 55
    12/17 15:13:24 [7860] <mfn_PostAgentInfo>Free memory difference: 5844992, Threshold: 175090470
    12/17 15:13:24 [7860] <mfn_PostAgentInfo>Free disk space difference: 184320, Threshold: 1676886210
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_SYLINK_QUERY_COMMANDSTATUS
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_SYLINK_QUERY_COMMANDSTATUS, return=0
    12/17 15:13:24 [7860] <IndexHeartbeatProc>===UPLOAD STAGE===
    12/17 15:13:24 [7860] <PostEvent>going to post event=EVENT_SERVER_READY_TO_UPLOAD_EVENT_LOG
    12/17 15:13:24 [7860] <PostEvent>done post event=EVENT_SERVER_READY_TO_UPLOAD_EVENT_LOG, return=0
    12/17 15:13:24 [7860] <IndexHeartbeatProc>===PREPARE EVENT LOG STAGE===
    12/17 15:13:24 [7860] <PrepareEventLog>initialized technology extension processing ok
    12/17 15:13:24 [7860] <CalcEventLogIndex>Need to send Event Log Type(0) from id 245 to 245
    12/17 15:13:24 [7860] <PrepareEventLog>Allow total logs to send=1
    12/17 15:13:24 [7860] <PrepareEventLog>nSecurityRecordsTotal=0
    12/17 15:13:24 [7860] <PrepareEventLog>nSecurityRecordsToSend=0
    12/17 15:13:24 [7860] <PrepareEventLog>nSystemRecordsTotal=1
    12/17 15:13:24 [7860] <PrepareEventLog>nSystemRecordsToSend=100
    12/17 15:13:24 [7860] <PrepareEventLog>nTrafficRecordsTotal=0
    12/17 15:13:24 [7860] <PrepareEventLog>nTrafficRecordsToSend=0
    12/17 15:13:24 [7860] <PrepareEventLog>nRawRecordsTotal=0
    12/17 15:13:24 [7860] <PrepareEventLog>nRawRecordsToSend=0
    12/17 15:13:24 [7860] <PrepareEventLog>nProcessRecordsTotal=0
    12/17 15:13:24 [7860] <PrepareEventLog>nProcessRecordsToSend=0
    12/17 15:13:24 [7860] <PrepareEventLog>nLANSensorRecordsTotal=0
    12/17 15:13:24 [7860] <PrepareEventLog>nLANSensorRecordsToSend=0
    12/17 15:13:24 [7860] <PrepareEventLog>nTechExtensionRecordsTotal=0
    12/17 15:13:24 [7860] <PrepareEventLog>nTechExtensionRecordsToSend=0
    12/17 15:13:24 [7860] <MakeSystemLog>The size of SYSTEM event logs is 436.
    12/17 15:13:24 [7860] <SyLink>The size of SYSTEM event logs is 436.
    12/17 15:13:24 [7860] <MakeSecurityLog>Attached total 0 bytes SECURITY event logs.
    12/17 15:13:24 [7860] <MakeTrafficLog>Attached total 0 bytes TRAFFIC event logs.
    12/17 15:13:24 [7860] <MakeRawTrafficLog>Attached total 0 bytes RAW TRAFFIC event logs.
    12/17 15:13:24 [7860] <MakeProcessLog>Attached total 0 bytes process event logs.
    12/17 15:13:24 [7860] <IndexHeartbeatProc>===COMPRESS EVENT LOG STAGE===
    12/17 15:13:24 [7860] <IndexHeartbeatProc>===SEND EVENT LOG STAGE===
    12/17 15:13:24 [7860] ************CSN=2235
    12/17 15:13:24 [7860] <mfn_MakePostUrl:>Request is: action=195&hostid=66520723AC14011E00B49B19786A07B1&chk=7508CE2C96ACE4E11F5BF942879B6A2C&ck=65F17674A2862F0679C5FCBB9FF0DC1E&uchk=E443E24602AC52BA34C6F0D12C86BF48&uck=981616E93E186BDCD9BC6F756281F7F0&groupid=60921551AC14011E00DD89F99DE7C345&as=2235&cn=[hex]44452D4C2D4358594842344A&lun=[hex]7674617570656E6173&udn=[hex]5345412E4C4F43414C
    12/17 15:13:25 [7860] <SendEventLogToServer>http://172.20.1.30:8014/secars/secars.dll?h=4A08D783AB6AC0BD939461B4DF6FA920E6DFC09BF433B1E853938B2CFB41A6248442C61DADE4E89A8DA0343B45289045FF625B6DB63D62016140AF2140753885E92DD6A18AFF60724AB55826CC6EED32E77EBEA18B4242ECC4D0E288341F63BDFB277988630CEBB15C36F9EC9FEA4F82F56580C0D5EA717A12D447B5D32F73A7EF1806B36FB8A8E28C0C467293C796CEE38FBA078C67CD05E9260A1DED4A9BA519D75095C3096608CEE0F7BCBF77B4031263078771197938E96608EF03447305B4B89D174CC3FE05D4FBC196AFD83AFFFAC9CF776D1529AB3FBD2A659DA01484E8B87DA81FAA13A3F6F1310C8D5CD78AE13C9C757D8BDB77F26277B19F23EA5428926FA1A75202895383E7ABA04C338792ABCEA0D2DA8E68BF0593EBF4AA97F470B0DCD67D574E217B05824BF8C14CE4821D5A532B0AA8700298621794E9B7594E38CFCBD3400522B4AAF0362FF6F4B6D09A354F11DEAA0D6D3AAD16D3C1E77E
    12/17 15:13:25 [7860] <SendEventLogToServer>eventlog-->SMS, size=378
    12/17 15:13:25 [7860] <SendEventLogToServer>uploads the eventlog to server, size=378
    12/17 15:13:25 [7860] <SendEventLogToServer>Query return code = 200
    12/17 15:13:25 [7860] <SendEventLogToServer>EventLog-->SEM DONE!
    12/17 15:13:25 [7860] <PostEvent>going to post event=EVENT_SERVER_EVENT_LOG_SENT
    12/17 15:13:25 [7860] <PostEvent>done post event=EVENT_SERVER_EVENT_LOG_SENT, return=0
    12/17 15:13:25 [7860] <IndexHeartbeatProc>Communication Mode=0(Push Mode)
    12/17 15:13:25 [7860] <IndexHeartbeatProc>Enter Push Session
    12/17 15:13:25 [7860] <IndexHeartbeatProc>Setting the session timeout on Profile Session (for MaintainPushConnection) to 320000
    12/17 15:13:25 [7860] <MaintainPushConnection:>Push Connecton!
    12/17 15:13:25 [7860] ************CSN=2236
    12/17 15:13:25 [7860] <mfn_MakeGetPushUrl:>Request is: action=128&hostid=66520723AC14011E00B49B19786A07B1&chk=7508CE2C96ACE4E11F5BF942879B6A2C&ck=65F17674A2862F0679C5FCBB9FF0DC1E&uchk=E443E24602AC52BA34C6F0D12C86BF48&uck=981616E93E186BDCD9BC6F756281F7F0&groupid=60921551AC14011E00DD89F99DE7C345&mode=0&as=2236
    12/17 15:13:25 [7860] <MaintainPushConnection:>http://172.20.1.30:8014/secars/secars.dll?h=BD526C1E23D83F61B24FA2A6E81EDA1AE6DFC09BF433B1E853938B2CFB41A6248442C61DADE4E89A8DA0343B45289045FF625B6DB63D62016140AF2140753885E92DD6A18AFF60724AB55826CC6EED32E77EBEA18B4242ECC4D0E288341F63BDFB277988630CEBB15C36F9EC9FEA4F82F56580C0D5EA717A12D447B5D32F73A7EF1806B36FB8A8E28C0C467293C796CEE38FBA078C67CD05E9260A1DED4A9BA519D75095C3096608CEE0F7BCBF77B4031263078771197938E96608EF03447305B4B89D174CC3FE05D4FBC196AFD83AFFFAC9CF776D1529AB3FBD2A659DA01484E8B87DA81FAA13A3F6F1310C8D5CD78AA6BBFE41B921F35AE945479CB2EF082C28F81CA8F7D19D8A117089C0A8ECF515
    12/17 15:14:23 [7576] <CSyLink::mfn_DownloadNow()>
    12/17 15:14:23 [7576] </CSyLink::mfn_DownloadNow()>
    12/17 15:15:23 [7576] <CSyLink::mfn_DownloadNow()>
    12/17 15:15:23 [7576] </CSyLink::mfn_DownloadNow()>
    12/17 15:16:24 [7576] <CSyLink::mfn_DownloadNow()>
    12/17 15:16:24 [7576] </CSyLink::mfn_DownloadNow()>
    12/17 15:17:25 [7576] <CSyLink::mfn_DownloadNow()>
    12/17 15:17:25 [7576] </CSyLink::mfn_DownloadNow()>
    12/17 15:18:25 [7576] <CSyLink::mfn_DownloadNow()>
    12/17 15:18:25 [7576] </CSyLink::mfn_DownloadNow()>
    12/17 15:18:44 [7860] <MaintainPushConnection:>SMS return=200
    12/17 15:18:44 [7860] <ParseHTTPStatusCode:>200=>200 OK
    12/17 15:18:44 [7860] <MaintainPushConnection:>RECEIVE STAGE COMPLETED
    12/17 15:18:44 [7860] <MaintainPushConnection:>COMPLETED
    12/17 15:18:44 [7860] <ScheduleNextUpdate>Manually assigned heartbeat=5 seconds
    12/17 15:18:44 [7860] HEARTBEAT: Check Point 8
    12/17 15:18:44 [7860] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
    12/17 15:18:44 [7860] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
    12/17 15:18:44 [7860] <IndexHeartbeatProc>====== IndexHeartbeat Procedure stops at 15:18:44 ======
    12/17 15:18:44 [7860] <IndexHeartbeatProc>Set Heartbeat Result= 2
    12/17 15:18:44 [7860] <IndexHeartbeatProc>Sylink Comm.Flags: 'Connection Failed' = 0, 'Using Backup Sylink' = 0, 'Using Location Config' = 0
    12/17 15:18:44 [7860] Use new configuration
    12/17 15:18:44 [7860] HEARTBEAT: Check Point Complete
    12/17 15:18:44 [7860] <IndexHeartbeatProc>Done, Heartbeat=5seconds
    12/17 15:18:44 [7860] </CSyLink::IndexHeartbeatProc()>
    12/17 15:18:44 [7860] <CheckHeartbeatTimer>====== Heartbeat loop stops at 15:18:44 ======
    12/17 15:18:49 [7860] <CheckHeartbeatTimer>====== Heartbeat loop starts at 15:18:49 ======
    12/17 15:18:49 [7860] <GetOnlineNicInfo>:Netport Count=4
    12/17 15:18:49 [7860] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="172.20.0.100" Mac="00-21-70-fa-d3-92" Gateway="172.20.1.254" SubnetMask="255.255.254.0"/><SSANIC Ip="192.168.18.1" Mac="00-50-56-c0-00-01" Gateway="0.0.0.0" SubnetMask="255.255.255.0"/><SSANIC Ip="192.168.91.1" Mac="00-50-56-c0-00-08" Gateway="0.0.0.0" SubnetMask="255.255.255.0"/><SSANIC Ip="192.168.56.1" Mac="08-00-27-00-a8-aa" Gateway="0.0.0.0" SubnetMask="255.255.255.0"/></SSANICs>
    12/17 15:18:49 [7860] <CalcAgentHashKey>:CH=60921551AC14011E00DD89F99DE7C3451DE-L-CXYHB4Jsea.localD713B9C43CAF71CC432D1564E2BE0465
    12/17 15:18:49 [7860] <CalcAgentHashKey>:CHKey=7508CE2C96ACE4E11F5BF942879B6A2C
    12/17 15:18:49 [7860] <CalcAgentHashKey>:C=60921551AC14011E00DD89F99DE7C3451DE-L-CXYHB4Jsea.local
    12/17 15:18:49 [7860] <CalcAgentHashKey>:CKey=65F17674A2862F0679C5FCBB9FF0DC1E
    12/17 15:18:49 [7860] <CalcAgentHashKey>:UCH=60921551AC14011E00DD89F99DE7C3450vtaupenasSEA.LOCALDE-L-CXYHB4Jsea.localD713B9C43CAF71CC432D1564E2BE0465
    12/17 15:18:49 [7860] <CalcAgentHashKey>:UCHKey=E443E24602AC52BA34C6F0D12C86BF48
    12/17 15:18:49 [7860] <CalcAgentHashKey>:UC=60921551AC14011E00DD89F99DE7C3450vtaupenasSEA.LOCALDE-L-CXYHB4Jsea.local
    12/17 15:18:49 [7860] <CalcAgentHashKey>:UCKey=981616E93E186BDCD9BC6F756281F7F0
    12/17 15:18:49 [7860] <DoHeartbeat>HardwareID=D713B9C43CAF71CC432D1564E2BE0465
    12/17 15:18:49 [7860] <DoHeartbeat>CHKey=7508CE2C96ACE4E11F5BF942879B6A2C
    12/17 15:18:49 [7860] <DoHeartbeat>CKey=65F17674A2862F0679C5FCBB9FF0DC1E
    12/17 15:18:49 [7860] <DoHeartbeat>UCHKey=E443E24602AC52BA34C6F0D12C86BF48
    12/17 15:18:49 [7860] <DoHeartbeat>UCKey=981616E93E186BDCD9BC6F756281F7F0
    12/17 15:18:49 [7860] <DoHeartbeat> Set heartbeat event
    12/17 15:18:49 [7860] Use new configuration
    12/17 15:18:49 [7860] <CSyLink::IndexHeartbeatProc()>
    12/17 15:18:49 [7860] <IndexHeartbeatProc> Got ConfigObject to proceed the operation.. pSylinkConfig: 0000000003E5EED0
    12/17 15:18:49 [7860] <IndexHeartbeatProc>====== Reg Heartbeat loop starts at 15:18:49 ======
    12/17 15:18:50 [7860] HEARTBEAT: Check Point 1
    12/17 15:18:50 [7860] Get First Server!
    12/17 15:18:50 [7860] HEARTBEAT: Check Point 2
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
    12/17 15:18:50 [7860] HEARTBEAT: Check Point 3
    12/17 15:18:50 [7860] <IndexHeartbeatProc>Setting the session timeout on Profile Session to 30000
    12/17 15:18:50 [7860] HEARTBEAT: Check Point 4
    12/17 15:18:50 [7860] <IndexHeartbeatProc>===Get Index STAGE===
    12/17 15:18:50 [7860] ************CSN=2237
    12/17 15:18:50 [7860] <mfn_MakeGetIndexUrl:>Request is: action=12&hostid=66520723AC14011E00B49B19786A07B1&chk=7508CE2C96ACE4E11F5BF942879B6A2C&ck=65F17674A2862F0679C5FCBB9FF0DC1E&uchk=E443E24602AC52BA34C6F0D12C86BF48&uck=981616E93E186BDCD9BC6F756281F7F0&hid=D713B9C43CAF71CC432D1564E2BE0465&groupid=60921551AC14011E00DD89F99DE7C345&mode=0&hbt=300&as=2237&cn=[hex]44452D4C2D4358594842344A&lun=[hex]7674617570656E6173&udn=[hex]5345412E4C4F43414C
    12/17 15:18:50 [7860] <GetIndexFileRequest:>http://172.20.1.30:8014/secars/secars.dll?h=3ECF391D70652ECBC37F50E4870BF3A2C3D65A8C6CAC8C7BE47B22719C20535E394BE569DB4D3E61B864CEFA49609351381044DDC72DEB711736FCBF41C177EA7311F4BF3244C0ECEA1D66D12CB505A45C7B052C09BB81A84E33AB05A2E8A8E9E948F1C6DD2DF22022824CB9A3EF1E9F6B488DB90D7392B2869543852B2F172B0A081E78665786A80BC54BE0932C1FB58F74F595119EB46B28DC346D8D9D50B3B88B858DD3C6A2D351C8234F2A2688A59C93A1135541F2EB3E08F85919A5C8B507336D5DC2E0CE9B136165DF836A9FCB00AB83C5EADF014E9B6EABE55B4324BB71DB338EFBA75895C3D3B3281D34C02F24506A49BFB3AB5A49ADC69B8569487D877E98E657C3708848DDBB83F71AEECEC20C02BB82674D04737A9094F316BC1770D377EFF8246ED168C153D05C075B57E10D4F140DE5C03174D2B4653B34B9F73AFF7DA2F29843A17D72E1BE8CD9BD59C5B70D4D5DF7DA4418182A9338E1D1E10EF7558814A6B3EDA8F8C640E58234A2E10FDD299921FDE3BFEC6D370E2CDE6023746B939D6D51147C28BA4D3AFCFDC3
    12/17 15:18:50 [7860] <GetIndexFileRequest:>SMS return=200
    12/17 15:18:50 [7860] <ParseHTTPStatusCode:>200=>200 OK
    12/17 15:18:50 [7860] <FindHeader>Sem-HashKey:=>E443E24602AC52BA34C6F0D12C86BF48
    12/17 15:18:50 [7860] <FindHeader>Sem-LANSensor:=>0
    12/17 15:18:50 [7860] <FindHeader>Sem-Signatue:=>4EDBC3E425D89E5E7534346EBCB6C8A26013E60708AE8DB0396D916FD7E96796E1CFCD00F1B3F47FBCAAA92F73580B05A9F20F17B862FE0149678CD264FE9C1B5004CD1C0D812E818EE3F891D3330ADA1713FDBA7672E9206738C36B70AB5D7DB79705424C5136CF0BFAF31317B58B3A466B620A09A9DBB04F9F321457ED8F7E
    12/17 15:18:50 [7860] <mfn_DoGetIndexFile200>Content Lenght => 1348
    12/17 15:18:50 [7860] SignIf::VerifySignature(data, dataLen, sig, sigLen) => Verification Successful..
    12/17 15:18:50 [7860] <mfn_DoGetIndexFile200>Index File: <?xml version="1.0" encoding="UTF-8" ?><GroupIndex SiteID="4F4208ECAC14011E0181B10D556705F7" ServerID="CD87E603AC14011E002F0BC1F7F279B7" GroupID="C8C50B53AC14011E00C26CAB4C7B8AC3" GroupCheckSum="842CEA790A323210858413531" LastModifiedTime = "17/12/2009 14:50:53">    <Profile Checksum="5D5D7176408440B54B97864D1501E649" SerialNumber="C8C5-12/17/2009 11:18:31 113" LastModifiedTime="17/12/2009  14:50:53"/>    <ConfigFile Checksum="E9C5C17C6FA93DEF68F702ABDC2CE5BC" LastModifiedTime="17/12/2009  14:50:53"/>    <IDSFile Checksum="703A0AE1B8EC84B36CDBAECB7E800283" LastModifiedTime="17/12/2009  14:50:53"/>    <SylinkFile Checksum="CCF857C2A211A633FA0A0254625ED4B0" LastModifiedTime="17/12/2009  14:50:53"/>    <LSProfile Checksum="C9B1934B063F485403B99A7BCFF8E81F" SerialNumber ="C8C5-12/17/2009 11:18:31 113" LastModifiedTime ="17/12/2009  14:50:53"/>
        <LiveUpdate>
            <File Checksum="C094305F3A4134609BDF7DD1B6C98529" DeltaFlag="1" FullSize="65369725" LastModifiedTime="1261045614373" Moniker="{C60DC234-65F9-4674-94AE-62158EFCA433}" Seq="91216052"/>
             <File Checksum="81E03046452A4DCAB6A4F9EAA2B92D48" DeltaFlag="1" FullSize="65561015" LastModifiedTime="1261045532547" Moniker="{1CD85198-26C6-4bac-8C72-5D34B025DE35}" Seq="91216052"/>
             <File Checksum="DD1F76B082B0AFDB9799D3DC779EEC84" DeltaFlag="1" FullSize="1336438" LastModifiedTime="1260580786085" Moniker="{42B17E5E-4E9D-4157-88CB-966FB4985928}" Seq="91209006"/>
             <File Checksum="10164252FAE8C4F702D6EBBFE3BD6BF9" DeltaFlag="1" FullSize="1320204" LastModifiedTime="1260580783767" Moniker="{D3769926-05B7-4ad1-9DCF-23051EEE78E3}" Seq="91209007"/>
             <File Checksum="A1141EC785568A889B6937B42E0FD28F" DeltaFlag="1" FullSize="669829" LastModifiedTime="1252940919563" Moniker="{C25CEA47-63E5-447b-8D95-C79CAE13FF79}" Seq="80929016"/>
             <File Checksum="A7A4E94BC6D70C843A301C21197DA678" DeltaFlag="1" FullSize="650307" LastModifiedTime="1252940926282" Moniker="{ECCC5006-EF61-4c99-829A-417B6C6AD963}" Seq="2008021700"/>
             <File Checksum="2177A8CF1A54442E017305AA7EE36300" DeltaFlag="1" FullSize="88188" LastModifiedTime="1252940981034" Moniker="{EA960B33-2196-4d53-8AC4-D5043A5B6F9B}" Seq="80820001"/>
             <File Checksum="8F557FE956C05D647720788736D76B5E" DeltaFlag="1" FullSize="1662247" LastModifiedTime="1252940986706" Moniker="{DB206823-FFD2-440a-9B89-CCFD45F3F1CD}" Seq="80820001"/>
             <File Checksum="92C95A60C8A8CD374801778F27D7A6ED" DeltaFlag="1" FullSize="1419193" LastModifiedTime="1252940996347" Moniker="{C13726A9-8DF7-4583-9B39-105B7EBD55E2}" Seq="80820001"/>
             <File Checksum="658900E48A6AA161EDF9D4B1134ECC46" DeltaFlag="1" FullSize="6487" LastModifiedTime="1258006847768" Moniker="{4F889C4A-784D-40de-8539-6A29BAA43139}" Seq="91111048"/>
             <File Checksum="524D4E4F75668339A376BE4544923D4E" DeltaFlag="1" FullSize="76805" LastModifiedTime="1260980520341" Moniker="{CC40C428-1830-44ef-B8B2-920A0B761793}" Seq="91216016"/>
             <File Checksum="52CF1EB4DDEFA5CE0A94B48AF824D72F" DeltaFlag="1" FullSize="744765" LastModifiedTime="1260980521487" Moniker="{812CD25E-1049-4086-9DDD-A4FAE649FBDF}" Seq="91216016"/>
             <File Checksum="EEC5958A3025A4DCE72070D72FFFE193" DeltaFlag="1" FullSize="744796" LastModifiedTime="1260980538975" Moniker="{E1A6B4FF-6873-4200-B6F6-04C13BF38CF3}" Seq="91216016"/>
             <File Checksum="34FF28C713E2383A7EB98026E9B93269" DeltaFlag="1" FullSize="76793" LastModifiedTime="1260980552758" Moniker="{E5A3EBEE-D580-421e-86DF-54C0B3739522}" Seq="91216016"/>
        </LiveUpdate>
    </GroupIndex>
    12/17 15:18:50 [7860] <GetIndexFileRequest:>RECEIVE STAGE COMPLETED
    12/17 15:18:50 [7860] <GetIndexFileRequest:>COMPLETED
    12/17 15:18:50 [7860] <IndexHeartbeatProc>GetIndexFile handling status: 0
    12/17 15:18:50 [7860] <IndexHeartbeatProc>Switch Server flag=0
    12/17 15:18:50 [7860] HEARTBEAT: Check Point 5.1
    12/17 15:18:50 [7860] <IsInClientIPorOnLink> NextHop is OnLink with 172.20.0.100,return TRUE
    12/17 15:18:50 [7860] <mfn_GetOutIP> Out IP is:172.20.0.100
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    12/17 15:18:50 [7860] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {C60DC234-65F9-4674-94AE-62158EFCA433} Seq:91216052
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    12/17 15:18:50 [7860] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {D3769926-05B7-4ad1-9DCF-23051EEE78E3} Seq:91209007
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    12/17 15:18:50 [7860] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {C13726A9-8DF7-4583-9B39-105B7EBD55E2} Seq:80820001
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    12/17 15:18:50 [7860] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {812CD25E-1049-4086-9DDD-A4FAE649FBDF} Seq:91216016
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
    12/17 15:18:50 [7860] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {E5A3EBEE-D580-421e-86DF-54C0B3739522} Seq:91216016
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_SERVER_ONLINE
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_SERVER_ONLINE, return=0
    12/17 15:18:50 [7860] <ScheduleNextUpdate>Reset Heartbeat factor index, hearbeat=300 seconds
    12/17 15:18:50 [7860] HEARTBEAT: Check Point 6
    12/17 15:18:50 [7860] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: AVMan
    12/17 15:18:50 [7860] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: GUP
    12/17 15:18:50 [7860] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: LUMan
    12/17 15:18:50 [7860] <mfn_PostAgentInfo>===REQUESTING CMC OP-STATE ===
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_SERVER_REQUIRES_CLIENT_SESTATE
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_SERVER_REQUIRES_CLIENT_SESTATE, return=0
    12/17 15:18:50 [7860] ReasonDescForFailure*** = La vérification de l'intégrité de l'hôte est désactivée.
    12/17 15:18:50 [7860] ReasonDescForFailure*** = La vérification de l'intégrité de l'hôte est désactivée.
    12/17 15:18:50 [7860] *** = <SSAInfo NameSpace="rpc" AgentID="66520723AC14011E00B49B19786A07B1" ComputerID="14E44C0AAC14011E00B49B1906102DD9" HardwareKey="D713B9C43CAF71CC432D1564E2BE0465" GroupID="C8C50B53AC14011E00C26CAB4C7B8AC3">
    <AgentHIInfo Status="3" ReasonCode="105" ReasonDescForFailure="La vérification de l'intégrité de l'hôte est désactivée."/>
    <SSAHostInfo>
    <NetworkIdentity UserDomain="SEA.LOCAL" LogonUser="vtaupenas" HostDomain="sea.local" HostName="DE-L-CXYHB4J" HostDesc=""/>
    <SSAProduct Version="11.0.5002.333"/>
    <SSAOS Version="6.1.7600" Desc="Windows 7 Enterprise Edition" Type="17170690" ServicePack="" Language="12"/>
    <Processor ProcessorType="Intel64 Family 6 Model 23 Stepping 10" ProcessorClock="2660" ProcessorNum="2"/>
    <Memory Size="4244549632"/>
    <Disk Letter="C:\" Size="61208522752"/>
    <BIOS Version="DELL   - 27d90911"/>
    <TpmDevice Id="0"/>
    <SSAProfile Version="5.0.0" SerialNumber="C8C5-12/17/2009 11:18:31 113"/>
    <SSAIDS Version="" SerialNumber=""/>
    <Deuce Signature="91209006"/>
    <SSAUTC Bias="-60"/>
    <DNSs><DNS Address="172.20.1.31"/><DNS Address="172.20.1.32"/></DNSs>
    <WINSs><WINS Address="172.20.1.33"/><WINS Address="172.20.1.34"/></WINSs>
    <DHCPServer Address="172.20.1.33"/><SSANICs><SSANIC Ip="172.20.0.100" Mac="00-21-70-fa-d3-92" Gateway="172.20.1.254" SubnetMask="255.255.254.0"/><SSANIC Ip="192.168.18.1" Mac="00-50-56-c0-00-01" Gateway="0.0.0.0" SubnetMask="255.255.255.0"/><SSANIC Ip="192.168.91.1" Mac="00-50-56-c0-00-08" Gateway="0.0.0.0" SubnetMask="255.255.255.0"/><SSANIC Ip="192.168.56.1" Mac="08-00-27-00-a8-aa" Gateway="0.0.0.0" SubnetMask="255.255.255.0"/></SSANICs><Firewall OnOff="1" Installed="1"/>
    </SSAHostInfo>
    <RebootRequired Status="0"></RebootRequired>
    <InstalledFeatures><Feature Id ="256"/></InstalledFeatures>
    </SSAInfo>

    12/17 15:18:50 [7860] <mfn_PostAgentInfo>Volatile op-state damper: 0, Interval passed: 326
    12/17 15:18:50 [7860] <mfn_PostAgentInfo>Free memory difference: 33071104, Threshold: 175090470
    12/17 15:18:50 [7860] <mfn_PostAgentInfo>Free disk space difference: 20480, Threshold: 1676886210
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_SYLINK_QUERY_COMMANDSTATUS
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_SYLINK_QUERY_COMMANDSTATUS, return=0
    12/17 15:18:50 [7860] <IndexHeartbeatProc>===UPLOAD STAGE===
    12/17 15:18:50 [7860] <PostEvent>going to post event=EVENT_SERVER_READY_TO_UPLOAD_EVENT_LOG
    12/17 15:18:50 [7860] <PostEvent>done post event=EVENT_SERVER_READY_TO_UPLOAD_EVENT_LOG, return=0
    12/17 15:18:50 [7860] <IndexHeartbeatProc>===PREPARE EVENT LOG STAGE===
    12/17 15:18:50 [7860] <PrepareEventLog>initialized technology extension processing ok
    12/17 15:18:50 [7860] <PrepareEventLog>Allow total logs to send=0
    12/17 15:18:50 [7860] <IndexHeartbeatProc>Communication Mode=0(Push Mode)
    12/17 15:18:50 [7860] <IndexHeartbeatProc>Enter Push Session
    12/17 15:18:50 [7860] <IndexHeartbeatProc>Setting the session timeout on Profile Session (for MaintainPushConnection) to 320000
    12/17 15:18:50 [7860] <MaintainPushConnection:>Push Connecton!
    12/17 15:18:51 [7860] ************CSN=2238
    12/17 15:18:51 [7860] <mfn_MakeGetPushUrl:>Request is: action=128&hostid=66520723AC14011E00B49B19786A07B1&chk=7508CE2C96ACE4E11F5BF942879B6A2C&ck=65F17674A2862F0679C5FCBB9FF0DC1E&uchk=E443E24602AC52BA34C6F0D12C86BF48&uck=981616E93E186BDCD9BC6F756281F7F0&groupid=60921551AC14011E00DD89F99DE7C345&mode=0&as=2238
    12/17 15:18:51 [7860] <MaintainPushConnection:>http://172.20.1.30:8014/secars/secars.dll?h=BD526C1E23D83F61B24FA2A6E81EDA1AE6DFC09BF433B1E853938B2CFB41A6248442C61DADE4E89A8DA0343B45289045FF625B6DB63D62016140AF2140753885E92DD6A18AFF60724AB55826CC6EED32E77EBEA18B4242ECC4D0E288341F63BDFB277988630CEBB15C36F9EC9FEA4F82F56580C0D5EA717A12D447B5D32F73A7EF1806B36FB8A8E28C0C467293C796CEE38FBA078C67CD05E9260A1DED4A9BA519D75095C3096608CEE0F7BCBF77B4031263078771197938E96608EF03447305B4B89D174CC3FE05D4FBC196AFD83AFFFAC9CF776D1529AB3FBD2A659DA01484E8B87DA81FAA13A3F6F1310C8D5CD78AA6BBFE41B921F35AE945479CB2EF082C7946B9AAAB97B39C47872051A4FC6CE0
    12/17 15:19:25 [7576] <CSyLink::mfn_DownloadNow()>
    12/17 15:19:25 [7576] </CSyLink::mfn_DownloadNow()>
    12/17 15:20:26 [7576] <CSyLink::mfn_DownloadNow()>
    12/17 15:20:26 [7576] </CSyLink::mfn_DownloadNow()>
    12/17 15:21:27 [7576] <CSyLink::mfn_DownloadNow()>
    12/17 15:21:27 [7576] </CSyLink::mfn_DownloadNow()>
    12/17 15:21:46 [3360] SyLinkDeleteConfig => Deleting instance: 00000000006B5BF0
    12/17 15:21:46 [3360] <PostEvent>going to post event=EVENT_SYLINK_CONFIG_SETTING_CHANGED
    12/17 15:21:46 [3360] <PostEvent>done post event=EVENT_SYLINK_CONFIG_SETTING_CHANGED, return=0
    12/17 15:21:46 [3360] <Stop>Stopping SyLink module...
    12/17 15:21:46 [7576] <MainThreadProc:>***** Main Thread Exit ****


    Thank you very much for the help !



  • 2.  RE: Endpoint Clients don't report their status to the management Console. But they are connected.

    Posted Dec 17, 2009 11:12 AM
    can you please try doing a repair of sepm from add/remove programs.
    before that,
    delete what ever is inside this folder ( take a backup)
    C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\inbox\agentinfo
    do u see large number of files?
    then run the repair.. 


  • 3.  RE: Endpoint Clients don't report their status to the management Console. But they are connected.

    Posted Dec 17, 2009 01:05 PM
    I'd like to confirm this is happening at our site too.  I originally noticed this while running MR4 MP1.  Clients stopped updating their virus defnition status to the management console around 11/15.  Rebooting the management server got about 1/3 of them to report correctly.  I then updated the server to MR5 and set all the clients to update to version 5002.  About 2/3 of the clients are now updated, but still only 1/3 of the clients report thier virus definition status.  Logging on to some of the "out of date" clients, the client itself reports up to date definitions.

    On Monday I will try the above suggestion about the delete/repair and report back.


  • 4.  RE: Endpoint Clients don't report their status to the management Console. But they are connected.

    Posted Dec 17, 2009 01:37 PM
    The mentioned folder "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\inbox\agentinfo" had a single file in it.  I backed this up, the deleted the one file. I'm going to assume this is because we use a SQL server for our database, not the embedded one.   When running the repair, it verified a bunch of files and the asked if I wanted to reconfigure the server.  Midway through this I canceled as it did not remember the sql settings and I did not have them handy.  One reboot later and we aren't any bettter off.


  • 5.  RE: Endpoint Clients don't report their status to the management Console. But they are connected.

    Posted Dec 17, 2009 02:03 PM
    Thanks for your replies.
    I will test your idea tomorrow.


  • 6.  RE: Endpoint Clients don't report their status to the management Console. But they are connected.

    Posted Dec 18, 2009 05:20 AM
    I tried your idea Rafeeq.
    Indeed i had 6500 files in the folder AgentInfo. I deleted all of them, then i did a repair.
    Now i have only 8 files but same problems.

    @mike_pitcha: I'm using a SQL 2008 database. But it didn't asked me if i wanted  reconfigure the server.


  • 7.  RE: Endpoint Clients don't report their status to the management Console. But they are connected.

    Posted Feb 11, 2010 02:37 PM
    Vincent,

    I have the same problem in our site.  If I delete old legacy proxy settings on both local user and system accounts, the clients report fine to the SEPM.  This however, only happens for a few days.  I think this is triggered by SEP wanting to go use HTTP proxy from our ISA 2004 server using anonymous access.  It keeps getting blocked, gets latest definitions, but does not report proper status.

    02/11 14:26:55 [3284] <IndexHeartbeatProc>===COMPRESS EVENT LOG STAGE===
    02/11 14:26:55 [3284] <IndexHeartbeatProc>===SEND EVENT LOG STAGE===
    02/11 14:26:55 [3284] ************CSN=2237
    02/11 14:26:55 [3284] <mfn_MakePostUrl:>Request is: action=195&hostid=A52294860A0102E9017456BCB125F5F0&chk=FBEC6167FDECB4610AA247D13F0998BA&ck=475840472E58228AA1D1DE17905ACA69&uchk=1FB0E63BF41689B2E6355D0462198D84&uck=C7A0B69CD82B7FFE6F058173858C2CBA&groupid=1B40FB3D0A0102E900584E976F7BB19C&as=2237&cn=[hex]6E6831303170633136&lun=[hex]6D61646861766173736A&udn=[hex]4E485248532E4E4554
    02/11 14:26:55 [3284] <SendEventLogToServer>http://10.1.2.233:8014/secars/secars.dll?h=A99226AAD0751B5B574C4AF161565AFD9BA9DD5092C13AE2CE6ABABC832CB87F7F4D3612D3DAE178525DBE4BE3F401690A6E6E2F8F4A0E4871373B52B89CD80A58A824A358EE888CD248B83CF4FF549C851A65D5CF603B55057B6B5067E78E8D8C51447D1E24DD1468E4196C09E97FCD61174CFC10DA7D0328A0D3B40435E6618D754DBA9A77BD783A3C8E9F261C1969F6855E730D9D2D9763520083CB573ED6972368AB90F9734612DE110EC48B1EE5042D5DA0FD89CB74F2B457713D56C7A99E837728852481AECDAB4DB0571C6101ECA34E3872C172E5DE450FAAF468F69E399FA8207CFB5EA6D0858A77ABE7827F595AC0A5C777F20F95D1A1331C781D24EBF4B281272B444BAE18528D85C242A669BB2BF9E984476F7B3E79B10455CE7EC167E55B46B41590F1A5FB60EBB8541F9B12B4C97E295E7E7492424731A1466971B066FCDE03C538594D120170698EBB036EBAC323ECAF759391D7993CDD7F52
    02/11 14:26:55 [3284] <SendEventLogToServer>eventlog-->SMS, size=918
    02/11 14:26:55 [3284] <SendEventLogToServer>No EndQuest result
    02/11 14:26:55 [3284] <IndexHeartbeatProc>===SEND EVENT LOG FAILED!!===

    Even with this in mind, the clients still get the latest definitions.  Did you do anything else in your environment?

     - madhavassj