Endpoint Protection

Last week I tried to upgrade SEPM from MR1 to MR5. In the process, the db was corrupted and I was taken through the process of installing SEPM MR5 and restoring the db (from a backup) by a Symantec Engineer.

Since then, I was advised to replace the sylink.xml files on clients to get them to report. I was also advised to delete the following registry keys from client machines prior to replacing the sylink.xml:
HKEY_USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\

Server: Windows 2003 x86 Sp2 Enterprise
Clients: Windows XP Sp3 and Windows 2003 Server x86 Sp2

Clients with winxp go through a proxy
Clients with win2003 do not go through a proxy.

Today I noticed when I first replace the sylink.xml using the sylink replacer tool, the client defs get updated but do not show a green dot below the symantec icon. Even a reboot does not cure this. I then re-ran the sylink replacer tool and the clients got the green dot below the symantec icon.

Here is a log from sylinkmonitor tool:

02/07 12:12:29 [3648] <ScheduleNextUpdate>Manually assigned heartbeat=1 seconds
02/07 12:12:30 [2600] <CheckHeartbeatTimer>====== Heartbeat loop starts at 12:12:30 ======
02/07 12:12:30 [2600] <GetOnlineNicInfo>:Netport Count=1
02/07 12:12:30 [2600] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="10.70.1.22" Mac="00-1a-64-c2-f2-56" Gateway="10.70.0.200" SubnetMask="0.0.0.0"/></SSANICs>
02/07 12:12:30 [2600] <CalcAgentHashKey>:CH=03D394940A3C013700744D21259CCB351servername.local8D1CA8315C6F0A58C1279C7187F7095C
02/07 12:12:30 [2600] <CalcAgentHashKey>:CHKey=C06BA37C70A7D0FD582729EDCD095D90
02/07 12:12:30 [2600] <CalcAgentHashKey>:C=03D394940A3C013700744D21259CCB351servername.local
02/07 12:12:30 [2600] <CalcAgentHashKey>:CKey=7CB03F47DD0D6704F7F68ABC723B67A9
02/07 12:12:30 [2600] <CalcAgentHashKey>:UCH=03D394940A3C013700744D21259CCB350admindomain.LOCALservername.local8D1CA8315C6F0A58C1279C7187F7095C
02/07 12:12:30 [2600] <CalcAgentHashKey>:UCHKey=1348C66A7116B747B0EE4B134BEB79B6
02/07 12:12:30 [2600] <CalcAgentHashKey>:UC=03D394940A3C013700744D21259CCB350admindomain.LOCALservername.local
02/07 12:12:30 [2600] <CalcAgentHashKey>:UCKey=A29765C075AFB71F822FE19EF87F11B9
02/07 12:12:30 [2600] <DoHeartbeat>HardwareID=8D1CA8315C6F0A58C1279C7187F7095C
02/07 12:12:30 [2600] <DoHeartbeat>CHKey=C06BA37C70A7D0FD582729EDCD095D90
02/07 12:12:30 [2600] <DoHeartbeat>CKey=7CB03F47DD0D6704F7F68ABC723B67A9
02/07 12:12:30 [2600] <DoHeartbeat>UCHKey=1348C66A7116B747B0EE4B134BEB79B6
02/07 12:12:30 [2600] <DoHeartbeat>UCKey=A29765C075AFB71F822FE19EF87F11B9
02/07 12:12:30 [2600] <DoHeartbeat> Set heartbeat event
02/07 12:12:30 [2600] Use new configuration
02/07 12:12:30 [2600] <CSyLink::IndexHeartbeatProc()>
02/07 12:12:30 [2600] <IndexHeartbeatProc> Got ConfigObject to proceed the operation.. pSylinkConfig: 01C342F8
02/07 12:12:30 [2600] <IndexHeartbeatProc>====== Reg Heartbeat loop starts at 12:12:30 ======
02/07 12:12:31 [2600] HEARTBEAT: Check Point 1
02/07 12:12:31 [2600] Get First Server!
02/07 12:12:31 [2600] HEARTBEAT: Check Point 2
02/07 12:12:31 [2600] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
02/07 12:12:31 [2600] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
02/07 12:12:31 [2600] HEARTBEAT: Check Point 3
02/07 12:12:31 [2600] <IndexHeartbeatProc>Setting the session timeout on Profile Session to 30000
02/07 12:12:31 [2600] HEARTBEAT: Check Point 4
02/07 12:12:31 [2600] <IndexHeartbeatProc>===Get Index STAGE===
02/07 12:12:31 [2600] ************CSN=355405
02/07 12:12:31 [2600] <mfn_MakeGetIndexUrl:>Request is: action=12&hostid=A287DAFB0A3C0137018EABF632BE1FC2&chk=C06BA37C70A7D0FD582729EDCD095D90&ck=7CB03F47DD0D6704F7F68ABC723B67A9&uchk=1348C66A7116B747B0EE4B134BEB79B6&uck=A29765C075AFB71F822FE19EF87F11B9&hid=8D1CA8315C6F0A58C1279C7187F7095C&groupid=03D394940A3C013700744D21259CCB35&mode=0&hbt=300&as=355405&cn=[hex]646673616861637372&lun=[hex]73797361646D696E32&udn=[hex]444653412E4C4F43414C
02/07 12:12:31 [2600] <GetIndexFileRequest:>http://avserver:8014/secars/secars.dll?h=2841BB9FBFF6F28E771ED3E5CDA089F7A7582E6BC1745935E10F22C8D975E6DF2D1D016D9BEFF7F4CC3779274F5D9AC0A72C741CC90493434784D058C7A91150E542260AE26F981B653530059E26EAD38135B3ECDB972D30415976090004AD503EB8F59F3834939BA2CAF6F85E5C934EDAC8CE59B1F8E01AC2D5F0A14844ED83ADEC529D6776D0B0F7C9B3D363E468B113F79935801BBB3C6A5CDEDC37A15577368491DC8E0B26B1DC38F13A1523974D814FBDD031E20D961B5FF649A6DFCCFFBB2F0D0CCD4CFBAB73029CD37E139B9EFEF437B508EDD52F9ACAF0D7B8E116682649B6DB9430CBFEFAE06F956EDEC3905C7C888642CEFBD3D64C025507FAE312A58F1FD71516C3C9E643A71AF96FB703B5EF2EFD6DF77DB43AB009E3CD4B96A0877B1A7F4721BCFB5F02AFF9B1373E1E5602C47A7657B949F3648F22899150B0CD9A54D428C6B837428CA34AC2C461CA0667ED0438C2D4C18604397ADA967557494CE420415E097A5BE868C8D307495744F4C1F965D611A83F7C604FB61C02EE261EFC93E1CE6C1831729EB7DBE1D7D7
02/07 12:12:31 [2600] <GetIndexFileRequest:>SMS return=200
02/07 12:12:31 [2600] <ParseHTTPStatusCode:>200=>200 OK
02/07 12:12:31 [2600] <FindHeader>Sem-HashKey:=>C06BA37C70A7D0FD582729EDCD095D90
02/07 12:12:31 [2600] <FindHeader>Sem-LANSensor:=>0
02/07 12:12:31 [2600] <FindHeader>Sem-Signatue:=>0A552D3B0E1B3D5B3CA428CBCAB1BC045585EF240F50973A179FDD66A524794742204EEFD1169C5D083B6A251B167319B55BF5A2F743A3B80F95ABE2219E34223F98F0299B8F953E8E9509B4996414C5937D3D480FAF21C5DF210E0FAA2CBB727835EB75BEA24CE64A8D04B4B7B62C3EBE675DDB41FD24C43E9C0EE91FB25C0F
02/07 12:12:31 [2600] <mfn_DoGetIndexFile200>Content Lenght => 1373
02/07 12:12:31 [2600] <mfn_DoGetIndexFile200>Signature verification FAILED for Index File Content..
02/07 12:12:31 [2600] <GetIndexFileRequest:>RECEIVE STAGE COMPLETED
02/07 12:12:31 [2600] <GetIndexFileRequest:>COMPLETED
02/07 12:12:31 [2600] <IndexHeartbeatProc>GetIndexFile handling status: 101
02/07 12:12:31 [2600] <IndexHeartbeatProc>Switch Server flag=0
02/07 12:12:31 [2600] HEARTBEAT: Check Point 5.1
02/07 12:12:31 [2600] <ScheduleNextUpdate>new scheduled heartbeat=256 seconds
02/07 12:12:31 [2600] HEARTBEAT: Check Point 8
02/07 12:12:31 [2600] Get Next Server!
02/07 12:12:31 [2600] <IndexHeartbeatProc>switch to another server
02/07 12:12:31 [2600] <DecrementScheduleTime:>New scheduled heartbeat=128 seconds
02/07 12:12:31 [2600] HEARTBEAT: Check Point 1
02/07 12:12:31 [2600] HEARTBEAT: Check Point 2
02/07 12:12:31 [2600] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
02/07 12:12:31 [2600] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
02/07 12:12:31 [2600] HEARTBEAT: Check Point 3
02/07 12:12:31 [2600] <IndexHeartbeatProc>Setting the session timeout on Profile Session to 30000
02/07 12:12:31 [2600] HEARTBEAT: Check Point 4
02/07 12:12:31 [2600] <IndexHeartbeatProc>===Get Index STAGE===
02/07 12:12:31 [2600] ************CSN=355406
02/07 12:12:31 [2600] <mfn_MakeGetIndexUrl:>Request is: action=12&hostid=A287DAFB0A3C0137018EABF632BE1FC2&chk=C06BA37C70A7D0FD582729EDCD095D90&ck=7CB03F47DD0D6704F7F68ABC723B67A9&uchk=1348C66A7116B747B0EE4B134BEB79B6&uck=A29765C075AFB71F822FE19EF87F11B9&hid=8D1CA8315C6F0A58C1279C7187F7095C&groupid=03D394940A3C013700744D21259CCB35&mode=0&hbt=300&as=355406&cn=[hex]646673616861637372&lun=[hex]73797361646D696E32&udn=[hex]444653412E4C4F43414C
02/07 12:12:31 [2600] <GetIndexFileRequest:>http://10.60.1.55:8014/secars/secars.dll?h=2841BB9FBFF6F28E771ED3E5CDA089F7A7582E6BC1745935E10F22C8D975E6DF2D1D016D9BEFF7F4CC3779274F5D9AC0A72C741CC90493434784D058C7A91150E542260AE26F981B653530059E26EAD38135B3ECDB972D30415976090004AD503EB8F59F3834939BA2CAF6F85E5C934EDAC8CE59B1F8E01AC2D5F0A14844ED83ADEC529D6776D0B0F7C9B3D363E468B113F79935801BBB3C6A5CDEDC37A15577368491DC8E0B26B1DC38F13A1523974D814FBDD031E20D961B5FF649A6DFCCFFBB2F0D0CCD4CFBAB73029CD37E139B9EFEF437B508EDD52F9ACAF0D7B8E116682649B6DB9430CBFEFAE06F956EDEC3905C7C888642CEFBD3D64C025507FAE312A58F1FD71516C3C9E643A71AF96FB703B5EF2EFD6DF77DB43AB009E3CD4B96A0877B1A7F4721BCFB5F02AFF9B1373E1E3C762B62FAC556428C6C7B4E587F8139CD9A54D428C6B837428CA34AC2C461CA0667ED0438C2D4C18604397ADA967557494CE420415E097A5BE868C8D307495744F4C1F965D611A83F7C604FB61C02EE261EFC93E1CE6C1831729EB7DBE1D7D7
02/07 12:12:31 [2600] <GetIndexFileRequest:>SMS return=200
02/07 12:12:31 [2600] <ParseHTTPStatusCode:>200=>200 OK
02/07 12:12:31 [2600] <FindHeader>Sem-HashKey:=>C06BA37C70A7D0FD582729EDCD095D90
02/07 12:12:31 [2600] <FindHeader>Sem-LANSensor:=>0
02/07 12:12:31 [2600] <FindHeader>Sem-Signatue:=>0A552D3B0E1B3D5B3CA428CBCAB1BC045585EF240F50973A179FDD66A524794742204EEFD1169C5D083B6A251B167319B55BF5A2F743A3B80F95ABE2219E34223F98F0299B8F953E8E9509B4996414C5937D3D480FAF21C5DF210E0FAA2CBB727835EB75BEA24CE64A8D04B4B7B62C3EBE675DDB41FD24C43E9C0EE91FB25C0F
02/07 12:12:31 [2600] <mfn_DoGetIndexFile200>Content Lenght => 1373
02/07 12:12:31 [2600] <mfn_DoGetIndexFile200>Signature verification FAILED for Index File Content..
02/07 12:12:31 [2600] <GetIndexFileRequest:>RECEIVE STAGE COMPLETED
02/07 12:12:31 [2600] <GetIndexFileRequest:>COMPLETED
02/07 12:12:31 [2600] <IndexHeartbeatProc>GetIndexFile handling status: 101
02/07 12:12:31 [2600] <IndexHeartbeatProc>Switch Server flag=0
02/07 12:12:31 [2600] HEARTBEAT: Check Point 5.1
02/07 12:12:31 [2600] <ScheduleNextUpdate>new scheduled heartbeat=256 seconds
02/07 12:12:31 [2600] HEARTBEAT: Check Point 8
02/07 12:12:31 [2600] Get Next Server!
02/07 12:12:31 [2600] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
02/07 12:12:31 [2600] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
02/07 12:12:31 [2600] <IndexHeartbeatProc>====== IndexHeartbeat Procedure stops at 12:12:31 ======
02/07 12:12:31 [2600] <IndexHeartbeatProc>Set Heartbeat Result= 1
02/07 12:12:31 [2600] <IndexHeartbeatProc>Sylink Comm.Flags: 'Connection Failed' = 0, 'Using Backup Sylink' = 0, 'Using Location Config' = 0
02/07 12:12:31 [2600] Use new configuration
02/07 12:12:31 [2600] HEARTBEAT: Check Point Complete
02/07 12:12:31 [2600] <IndexHeartbeatProc>Done, Heartbeat=256seconds
02/07 12:12:31 [2600] </CSyLink::IndexHeartbeatProc()>
02/07 12:12:31 [2600] <CheckHeartbeatTimer>====== Heartbeat loop stops at 12:12:31 ======
02/07 12:12:54 [5100] <CSyLink::mfn_DownloadNow()>
02/07 12:12:54 [5100] </CSyLink::mfn_DownloadNow()>
02/07 12:13:54 [5100] <CSyLink::mfn_DownloadNow()>
02/07 12:13:54 [5100] </CSyLink::mfn_DownloadNow()>
02/07 12:14:54 [5100] <CSyLink::mfn_DownloadNow()>
02/07 12:14:54 [5100] </CSyLink::mfn_DownloadNow()>
02/07 12:15:54 [5100] <CSyLink::mfn_DownloadNow()>
02/07 12:15:54 [5100] </CSyLink::mfn_DownloadNow()>
02/07 12:16:48 [2600] <CheckHeartbeatTimer>====== Heartbeat loop starts at 12:16:48 ======
02/07 12:16:49 [2600] <GetOnlineNicInfo>:Netport Count=1
02/07 12:16:49 [2600] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="10.70.1.22" Mac="00-1a-64-c2-f2-56" Gateway="10.70.0.200" SubnetMask="0.0.0.0"/></SSANICs>
02/07 12:16:49 [2600] <CalcAgentHashKey>:CH=03D394940A3C013700744D21259CCB351servername.local8D1CA8315C6F0A58C1279C7187F7095C
02/07 12:16:49 [2600] <CalcAgentHashKey>:CHKey=C06BA37C70A7D0FD582729EDCD095D90
02/07 12:16:49 [2600] <CalcAgentHashKey>:C=03D394940A3C013700744D21259CCB351servername.local
02/07 12:16:49 [2600] <CalcAgentHashKey>:CKey=7CB03F47DD0D6704F7F68ABC723B67A9
02/07 12:16:49 [2600] <CalcAgentHashKey>:UCH=03D394940A3C013700744D21259CCB350admindomain.LOCALservername.local8D1CA8315C6F0A58C1279C7187F7095C
02/07 12:16:49 [2600] <CalcAgentHashKey>:UCHKey=1348C66A7116B747B0EE4B134BEB79B6
02/07 12:16:49 [2600] <CalcAgentHashKey>:UC=03D394940A3C013700744D21259CCB350admindomain.LOCALservername.local
02/07 12:16:49 [2600] <CalcAgentHashKey>:UCKey=A29765C075AFB71F822FE19EF87F11B9
02/07 12:16:49 [2600] <DoHeartbeat>HardwareID=8D1CA8315C6F0A58C1279C7187F7095C
02/07 12:16:49 [2600] <DoHeartbeat>CHKey=C06BA37C70A7D0FD582729EDCD095D90
02/07 12:16:49 [2600] <DoHeartbeat>CKey=7CB03F47DD0D6704F7F68ABC723B67A9
02/07 12:16:49 [2600] <DoHeartbeat>UCHKey=1348C66A7116B747B0EE4B134BEB79B6
02/07 12:16:49 [2600] <DoHeartbeat>UCKey=A29765C075AFB71F822FE19EF87F11B9
02/07 12:16:49 [2600] <DoHeartbeat> Set heartbeat event
02/07 12:16:49 [2600] Use new configuration
02/07 12:16:49 [2600] <CSyLink::IndexHeartbeatProc()>
02/07 12:16:49 [2600] <IndexHeartbeatProc> Got ConfigObject to proceed the operation.. pSylinkConfig: 01C342F8
02/07 12:16:49 [2600] <IndexHeartbeatProc>====== Reg Heartbeat loop starts at 12:16:49 ======
02/07 12:16:49 [2600] HEARTBEAT: Check Point 1
02/07 12:16:49 [2600] Get First Server!
02/07 12:16:49 [2600] HEARTBEAT: Check Point 2
02/07 12:16:49 [2600] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
02/07 12:16:49 [2600] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
02/07 12:16:49 [2600] HEARTBEAT: Check Point 3
02/07 12:16:49 [2600] <IndexHeartbeatProc>Setting the session timeout on Profile Session to 30000
02/07 12:16:49 [2600] HEARTBEAT: Check Point 4
02/07 12:16:49 [2600] <IndexHeartbeatProc>===Get Index STAGE===
02/07 12:16:49 [2600] ************CSN=355407
02/07 12:16:49 [2600] <mfn_MakeGetIndexUrl:>Request is: action=12&hostid=A287DAFB0A3C0137018EABF632BE1FC2&chk=C06BA37C70A7D0FD582729EDCD095D90&ck=7CB03F47DD0D6704F7F68ABC723B67A9&uchk=1348C66A7116B747B0EE4B134BEB79B6&uck=A29765C075AFB71F822FE19EF87F11B9&hid=8D1CA8315C6F0A58C1279C7187F7095C&groupid=03D394940A3C013700744D21259CCB35&mode=0&hbt=300&as=355407&cn=[hex]646673616861637372&lun=[hex]73797361646D696E32&udn=[hex]444653412E4C4F43414C
02/07 12:16:49 [2600] <GetIndexFileRequest:>http://10.60.1.55:8014/secars/secars.dll?h=2841BB9FBFF6F28E771ED3E5CDA089F7A7582E6BC1745935E10F22C8D975E6DF2D1D016D9BEFF7F4CC3779274F5D9AC0A72C741CC90493434784D058C7A91150E542260AE26F981B653530059E26EAD38135B3ECDB972D30415976090004AD503EB8F59F3834939BA2CAF6F85E5C934EDAC8CE59B1F8E01AC2D5F0A14844ED83ADEC529D6776D0B0F7C9B3D363E468B113F79935801BBB3C6A5CDEDC37A15577368491DC8E0B26B1DC38F13A1523974D814FBDD031E20D961B5FF649A6DFCCFFBB2F0D0CCD4CFBAB73029CD37E139B9EFEF437B508EDD52F9ACAF0D7B8E116682649B6DB9430CBFEFAE06F956EDEC3905C7C888642CEFBD3D64C025507FAE312A58F1FD71516C3C9E643A71AF96FB703B5EF2EFD6DF77DB43AB009E3CD4B96A0877B1A7F4721BCFB5F02AFF9B1373E1E17A037CD662FC7B0CED514BB212796CFCD9A54D428C6B837428CA34AC2C461CA0667ED0438C2D4C18604397ADA967557494CE420415E097A5BE868C8D307495744F4C1F965D611A83F7C604FB61C02EE261EFC93E1CE6C1831729EB7DBE1D7D7
02/07 12:16:49 [2600] <GetIndexFileRequest:>SMS return=200
02/07 12:16:49 [2600] <ParseHTTPStatusCode:>200=>200 OK
02/07 12:16:49 [2600] <FindHeader>Sem-HashKey:=>C06BA37C70A7D0FD582729EDCD095D90
02/07 12:16:49 [2600] <FindHeader>Sem-LANSensor:=>0
02/07 12:16:49 [2600] <FindHeader>Sem-Signatue:=>0A552D3B0E1B3D5B3CA428CBCAB1BC045585EF240F50973A179FDD66A524794742204EEFD1169C5D083B6A251B167319B55BF5A2F743A3B80F95ABE2219E34223F98F0299B8F953E8E9509B4996414C5937D3D480FAF21C5DF210E0FAA2CBB727835EB75BEA24CE64A8D04B4B7B62C3EBE675DDB41FD24C43E9C0EE91FB25C0F
02/07 12:16:49 [2600] <mfn_DoGetIndexFile200>Content Lenght => 1373
02/07 12:16:49 [2600] <mfn_DoGetIndexFile200>Signature verification FAILED for Index File Content..
02/07 12:16:49 [2600] <GetIndexFileRequest:>RECEIVE STAGE COMPLETED
02/07 12:16:49 [2600] <GetIndexFileRequest:>COMPLETED
02/07 12:16:49 [2600] <IndexHeartbeatProc>GetIndexFile handling status: 101
02/07 12:16:49 [2600] <IndexHeartbeatProc>Switch Server flag=0
02/07 12:16:49 [2600] HEARTBEAT: Check Point 5.1
02/07 12:16:49 [2600] <ScheduleNextUpdate>new scheduled heartbeat=512 seconds
02/07 12:16:49 [2600] HEARTBEAT: Check Point 8
02/07 12:16:49 [2600] Get Next Server!
02/07 12:16:49 [2600] <IndexHeartbeatProc>switch to another server
02/07 12:16:49 [2600] <DecrementScheduleTime:>New scheduled heartbeat=256 seconds
02/07 12:16:50 [2600] HEARTBEAT: Check Point 1
02/07 12:16:50 [2600] HEARTBEAT: Check Point 2
02/07 12:16:50 [2600] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
02/07 12:16:50 [2600] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
02/07 12:16:50 [2600] HEARTBEAT: Check Point 3
02/07 12:16:50 [2600] <IndexHeartbeatProc>Setting the session timeout on Profile Session to 30000
02/07 12:16:50 [2600] HEARTBEAT: Check Point 4
02/07 12:16:50 [2600] <IndexHeartbeatProc>===Get Index STAGE===
02/07 12:16:50 [2600] ************CSN=355408
02/07 12:16:50 [2600] <mfn_MakeGetIndexUrl:>Request is: action=12&hostid=A287DAFB0A3C0137018EABF632BE1FC2&chk=C06BA37C70A7D0FD582729EDCD095D90&ck=7CB03F47DD0D6704F7F68ABC723B67A9&uchk=1348C66A7116B747B0EE4B134BEB79B6&uck=A29765C075AFB71F822FE19EF87F11B9&hid=8D1CA8315C6F0A58C1279C7187F7095C&groupid=03D394940A3C013700744D21259CCB35&mode=0&hbt=300&as=355408&cn=[hex]646673616861637372&lun=[hex]73797361646D696E32&udn=[hex]444653412E4C4F43414C
02/07 12:16:50 [2600] <GetIndexFileRequest:>http://avserver:8014/secars/secars.dll?h=2841BB9FBFF6F28E771ED3E5CDA089F7A7582E6BC1745935E10F22C8D975E6DF2D1D016D9BEFF7F4CC3779274F5D9AC0A72C741CC90493434784D058C7A91150E542260AE26F981B653530059E26EAD38135B3ECDB972D30415976090004AD503EB8F59F3834939BA2CAF6F85E5C934EDAC8CE59B1F8E01AC2D5F0A14844ED83ADEC529D6776D0B0F7C9B3D363E468B113F79935801BBB3C6A5CDEDC37A15577368491DC8E0B26B1DC38F13A1523974D814FBDD031E20D961B5FF649A6DFCCFFBB2F0D0CCD4CFBAB73029CD37E139B9EFEF437B508EDD52F9ACAF0D7B8E116682649B6DB9430CBFEFAE06F956EDEC3905C7C888642CEFBD3D64C025507FAE312A58F1FD71516C3C9E643A71AF96FB703B5EF2EFD6DF77DB43AB009E3CD4B96A0877B1A7F4721BCFB5F02AFF9B1373E1E02B5F2244AA68434AADAEE26A9A745BBCD9A54D428C6B837428CA34AC2C461CA0667ED0438C2D4C18604397ADA967557494CE420415E097A5BE868C8D307495744F4C1F965D611A83F7C604FB61C02EE261EFC93E1CE6C1831729EB7DBE1D7D7
02/07 12:16:50 [2600] <GetIndexFileRequest:>SMS return=200
02/07 12:16:50 [2600] <ParseHTTPStatusCode:>200=>200 OK
02/07 12:16:50 [2600] <FindHeader>Sem-HashKey:=>C06BA37C70A7D0FD582729EDCD095D90
02/07 12:16:50 [2600] <FindHeader>Sem-LANSensor:=>0
02/07 12:16:50 [2600] <FindHeader>Sem-Signatue:=>0A552D3B0E1B3D5B3CA428CBCAB1BC045585EF240F50973A179FDD66A524794742204EEFD1169C5D083B6A251B167319B55BF5A2F743A3B80F95ABE2219E34223F98F0299B8F953E8E9509B4996414C5937D3D480FAF21C5DF210E0FAA2CBB727835EB75BEA24CE64A8D04B4B7B62C3EBE675DDB41FD24C43E9C0EE91FB25C0F
02/07 12:16:50 [2600] <mfn_DoGetIndexFile200>Content Lenght => 1373
02/07 12:16:50 [2600] <mfn_DoGetIndexFile200>Signature verification FAILED for Index File Content..
02/07 12:16:50 [2600] <GetIndexFileRequest:>RECEIVE STAGE COMPLETED
02/07 12:16:50 [2600] <GetIndexFileRequest:>COMPLETED
02/07 12:16:50 [2600] <IndexHeartbeatProc>GetIndexFile handling status: 101
02/07 12:16:50 [2600] <IndexHeartbeatProc>Switch Server flag=0
02/07 12:16:50 [2600] HEARTBEAT: Check Point 5.1
02/07 12:16:50 [2600] <ScheduleNextUpdate>new scheduled heartbeat=512 seconds
02/07 12:16:50 [2600] HEARTBEAT: Check Point 8
02/07 12:16:50 [2600] Get Next Server!
02/07 12:16:50 [2600] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
02/07 12:16:50 [2600] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
02/07 12:16:50 [2600] <IndexHeartbeatProc>====== IndexHeartbeat Procedure stops at 12:16:50 ======
02/07 12:16:50 [2600] <IndexHeartbeatProc>Set Heartbeat Result= 1
02/07 12:16:50 [2600] <IndexHeartbeatProc>Sylink Comm.Flags: 'Connection Failed' = 0, 'Using Backup Sylink' = 0, 'Using Location Config' = 0
02/07 12:16:50 [2600] Use new configuration
02/07 12:16:50 [2600] HEARTBEAT: Check Point Complete
02/07 12:16:50 [2600] <IndexHeartbeatProc>Done, Heartbeat=512seconds
02/07 12:16:50 [2600] </CSyLink::IndexHeartbeatProc()>
02/07 12:16:50 [2600] <CheckHeartbeatTimer>====== Heartbeat loop stops at 12:16:50 ======
02/07 12:16:54 [5100] <CSyLink::mfn_DownloadNow()>
02/07 12:16:54 [5100] </CSyLink::mfn_DownloadNow()>
02/07 12:17:55 [5100] <CSyLink::mfn_DownloadNow()>
02/07 12:17:55 [5100] </CSyLink::mfn_DownloadNow()>
02/07 12:18:55 [5100] <CSyLink::mfn_DownloadNow()>
02/07 12:18:55 [5100] </CSyLink::mfn_DownloadNow()>


Any advise on why I need to run the tool twice is  much appreciated.

Thanks,
Clint

not sure why it needs to run twice may be the first one failed to copy.
however , since you have you DB, if you have followed disaster recovery , replacing the JKS file should get your clients online,
have you followed this document ?

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007082112135948

i have to run it twice on every client machine... must be something wrong with sylinkreplacer?

it need not have to replace twice
try deleting sylink.dak file and then run the sylink tool twice
all the tool does is to stop smc service
replace sylink
restart smc

Try the sylink remote and see what happens

https://www-secure.symantec.com/connect/articles/how-run-sylink-remote-replace-sylink-remotely
https://www-secure.symantec.com/connect/downloads/sylink-remote

Signature verification FAILED for Index File Content..

I could see the above error in the Sylink log. This basiclly means that the certificate registration for a client with SEPM has failed. If this is the case, the client will connect with the SEPM upon reboot and due to invalid certificate, the connection will be dropped. To by-pass this,

Open the Sylink.Xml and next to server's hostname, you will find "Verify Signatures" parameter. Change the value to 0 and also change the hostname of server to FQDN in the same line. Now, replace this sylink file on the clients and they will communicate. Once they establish communication, they will automatically update themselves with the correct SEPM certificate.