Endpoint Protection

Hi Everyone,

I'm trying to solve an issue that has crept up since I upgraded my SEPM's from 11.0.6a to 11.0.6mp3.  Occasionally one of my SEPM's on the primary site will stop responding and I'll get a Server Health Alert from one of the other SEPM's saying that it is offline:

Server SEPM-Console2 health status: offline. Reason: Server has not reported new status in over 10 minutes. Status reported on 2011-07-20 09:52:36.

See attached report for more details.

The attached report is just the Site Status report that lists the status of the bad SEPM as "Offline".  Restarting the SEPM service has no effect.  Rebooting the server itself has no effect.  And looking at the tomcat logs doesn't reveal anything useful.  However, the logs do stay static after the initial boot of the machine, even though there are hundreds of clients connecting to port 443 of that server.

Then, setting the logging to "FINEST" and restarting the SEPM service, I see the following in 'scm-server-0.log'

2011-07-20 10:08:04.466 INFO: Server startup
2011-07-20 10:08:04.575 INFO: Server side cache PERCETAGE_OF_TOTAL_MEMORY=0.3  PERCETAGE_OF_MEMORY_TO_REMOVE=0.2
2011-07-20 10:08:06.653 FINE: updProcessState: checking...
2011-07-20 10:08:06.653 FINE: updProcessState is busy since Tuesday, July 19, 2011 4:02:52 PM PDT locked by F10BEB784036884D013736C156002FE2 (GetChangedMetadataHandler)
2011-07-20 10:08:06.653 WARNING: updProcessState ProcessState is locked over 3600. Please restart all SEPM services on this site to unlock it.

After I restart all SEPM services on that site, including the original problem SEPM, does everything start working again.  But the problem creeps up again about a month later.

Has anyone else ran into this? 

Is the connection in TIME_WAIT or ESTABLISHED between the 2 SEPMs?

Do you have enough free space in C: drive?( where the SEPM is installed).

Are all the temporary files cleaned up?

Please run the management server configuration wizard one more time if you have enough space on c drive.

Good Luck!

check in the eventviewer for the said time to look for mor einformation and post it here.

with the error, are you experiencing any difficulty in operating SEPM?

system event viewer for the SEPM shows nothing.  iis logs show nothing.  tomcat logs showed nothing until i turned on fine logging.  sql server logs showed nothing.  system event viewer for the sql server showed nothing.

with the error, i am unable to login to that specific SEPM via the java console and the web console wouldn't even launch, but the other SEPMs in the site continued to function. 

So, there's no communication between the 2 sites. If this happened immediately after upgrading, then it might be a corrupted install. Try repairing if that's the case.