Endpoint Protection

Within the last two weeks or so I've started to experience a very intermittent problem while trying to Export from the Monitors -> Logs tab.  From what I can tell at the moment I have no reason to believe that it is truely "Timing Out".  I think the issue is related to some sort of corrupt field within the database.  I've contacted SEP support and at the moment I'm not getting a warm feeling(as usual) that they're going to be able to resolve my issue.  Has anyone else experienced this issue in the past?

What I've been able to do is by adding filters it seems I can narrow it somewhat down to a handful of entries.  One other thing to note is that I received the link(shown below) to a Symantec article from support about the reporting.log file and after opening it I found the following info that I attached to this as reporting.txt 

http://www.symantec.com/business/support/index?page=content&id=TECH164854&profileURL=https%3A%2F%2Fsymaccount-profile.symantec.com%2FSSO%2Findex.jsp%3FssoID%3D1366130662465AH6rUfM5Wfl4pVm2PC9PKp8qWaulIes3E6tBD

Also note that I have been on SEPM version 12.1.2 since early December and we just started experiencing this issue a few weeks ago.  And we do not change permissions in out SQL DB.

Attachment(s)

reporting.txt   8 KB 1 version

How much data are we talking about client-wise? More than 10k clients? 20k? More?

With large amounts of data I've seen this but not at a constant rate.

Hello,

Basically this happens that for some reason when the database is not upgraded during the migration from a previous version .

In that case go to - 

\Program Files\Symantec\Symantec Endpoint Protection Manager\bin  (substitute Program Files (x86) in this path if working on a 64 bit system ) and run upgrade.bat then repair the Symantec Endpoint Protection Manager installation through Control Panel - Add / Remove programs.

Also, check this Article:

Error: Query failed when running Comprehensive Risk Report for 24 hours

http://www.symantec.com/docs/TECH136691

Hope this works for you!!

Brian,

I currently have approx 20k clients.  Like I said very intermittent.  But it when it does occur it seems repeatable.  And it seems to occur for small portions of data.  But of course if you are pulling a large report that queries the same seciton of data then it seems you'll receive the failed message also.

Mithun,

Could this still be the case even though its been functioning for about 4months now without issue?  And all the sudden we started receiving this when tyring to export reports we regularly use?

Is there any illadverse affects by running the upgrade.bat after we've been using it in a SEP 12 environment for quite sometime now? 

Thanks

Has support tried anything other than sending you the article linked above? Did you try any troubleshooting, such as a repair?

Brian,

I have tried a repair myself with no luck.  Support has not provided me any further troubleshooting steps.  Although they are suppose to be getting back to me today. 

I am a bit interested in what Mithun stated although it sounds a bit risky.  Do you think this would have potential to resolve an issue like I'm experiencing?

Ensure you've taken a backup first. You can run the upgrade.bat file. If nothing needs to changed than the risk should be very low.

Mithun,

I did follow the steps in the article you provided and I was able to pull the Comprehensive Risk Report for a 24hr period.  Like I said before although it states a Time Out Error message I really don't think it times out.  Specifically because some of the queries that fail are of only 5 or 6 machines and other queries that run successfully can be upwards of 14000 computer entries.

So working with SEP support they've come to the conclusion that it is entries within my database that are corrupt.  They have given me the option to either work with my SQL DB and purge the entries that are corrupt or locate those machines and upgrade them from SEP 11 to SEP 12 since apparently this will clear up their issue in the DB.  My question is if I want to approach it from the SQL DB side and purge these entries and let them re-populate does anyone have the SEP Schema so I can point the SQL DB in the right direction as to which entries need to be removed? 

Can be found here:

Symantec Endpoint Protection Manager 12.1.2 Database Schema

Hello,

Here is the Database Schema for SEP 12.1 RU2

Symantec Endpoint Protection Manager 12.1.2 Database Schema

http://www.symantec.com/docs/DOC6039

Secondly, Incase you want to know more about sql queries, then you can see this Thread:

www-secure.symantec.com/connect/forums/sql-querys-database

Hope that helps!!