Endpoint Protection

Hi All,

Good Day..

We are using Sep 12.1 RU1 MP1 on a windows Architecture,

We having scheduled reports configured and which is intended to run after 8 AM of every day. Initially it runs on proper time, after three months we noticed that the time is getting postponed and yesterday we notice that it ran on 11.30.

Can anyone suggest why this lag on Scheduled report?

Regards

Ajin

hello,

Just check...

Delete the Scheduled report and recreate .

Hello,

I think this is how the product is design, if you see the time frame its run schedule report after 8 AM, so lets say for some reasons if your server is busy @ 8 AM then the report might get generated at around 8:15 AM & once the report is generated there is a internal timer which gets triggred so the next day the same report will get triggred at 8:15 hence with the same logic the report starts getting delayed from its actual time and u can see the same report get delivered long after the expected schedule may be after 4 - 5 months of its creation.

So u can reschedule the report and make sure the time you are chosing for rescheduling will be a time when ur server would be least busy.

Hi,

Check this article:

Scheduled reports don't cover the expected scheduled time

http://www.symantec.com/docs/TECH173856

However you can check the ScheduledReportingTask and SecurityNotifyTask log files for further analysis.

It would be present under following locations.

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\logs

Searching for the keyword “Exception” can help you quickly identify problems with the report or notification itself

Hi manish,

If we delete the Scheduled report and create the report may fix the problem mean while .

For a long run it is not a amicable solution

Regards

Ajin

Hi Kavin,

Thanks for your information’s.

As per tech TECH173856  also saying the same .

Regards

Ajin

Hi, 

Thumbs UP for above.

Regards

Ajin

Hi All,

Thanks for all your valuable inputs.

Concluding the case as blow.

Problem

Scheduled reports

• Are not covering the expected time frame (For example:  Expected to cover at 00:00 yesterday - 00:00 today, but instead covers a few minutes later, i.e. 00:02 yesterday - 00:02 today).
• Are missing data, which falls into the interval that is not covered.
• Which scheduled to run late, actually runs the next day.

Cause

This is by design.

Scheduled reports are not meant to cover the exact time, as they are designed to cover the time specified from the time they were actually run.

ie.  If the report was run late and was supposed to cover a 24 hour interval, it will cover the 24 hour interval from the time it was run.

It will also be scheduled to run, at best, 24 hours in the future from the time it was run.

i.e. If it was run two minutes late, next time, at best, it will run two minutes late. 

Reasons for this, some other reports that were scheduled to run at the same time, may be running or replication is happening or even liveupdate running at the time.

Because if one process is running on the database, it would have locked the database, so that the other process cannot read (initiate action) and thus, would have to wait until the current process ended.

Solution

A workaround to this would be, if using a (Microsoft - SQL DB) MSSQL database, then the logs can be parsed via IT Analytics.

# Inputs from TECH173856

Regards

Ajin