Hi All

 

 

           Is there any method that i can recover the sem5.db ? i deleted my mistake, i have a full backup but it was in 9 Feb, i have tried to copied back to the path, but seem not work, any solution how to fix my case ? Thanks

 

 

Keith

What version of SEP is this for?

Symantec Endpoint Protection 12.1: Best Practices for Disaster Recovery with the Symantec Endpoint Protection Manager

Article:TECH160736

|

Created: 2011-05-24

|

Updated: 2013-11-25

|

Article URL http://www.symantec.com/docs/TECH160736

 

Symantec Endpoint Protection 11.x: Best Practices for Disaster Recovery with the Symantec Endpoint Protection Manager

Article:TECH102333

|

Created: 2007-01-21

|

Updated: 2011-11-09

|

Article URL http://www.symantec.com/docs/TECH102333

 

i have a backup from the symantec folder,  but it was a version in 9 Feb, can i still recover from that backup ?

 

 

Yes just follow the DR steps for the version of SEPM that you're running I linked above

 

got it now i am restoring below, for the 12.1 source, where i can download it, as i can not found the disc, Thx !

 

Server Private Key

 

\Program Files\Symantec\Symantec Endpoint Protection Manager\data\backup

https://fileconnect.symantec.com using your serial number

 

My private key date was in 2011 , is that fine ?

 

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Server Private Key Backup\recovery_2011-11-29-01-30-53.zip

if the backup is the version for SEP 11, you should be installing same version of SEPM.

i can not find the serial no , i only have customer number, i can not download the SEP12.1 , any other way that i can download the SEP12.1 ?

Serial Numbers is usually the 'M' number which can be obtained from the purchase documentation 

You can contact to Licensing Department, You can contact Symantec Licensing Department for the same.

Website: http://symantec.custhelp.com

Phone number: 1-800-721-3934

Email: license@symantec.com

 

I have found, but is show below version

Symantec Protection Suite Enterprise Edition 3.0

Symantec Protection Suite Enterprise Edition it's bundle version.

You can find below product on Symantec Protection Suite,You can Enter your serial no and download SEPM version 

 

• Endpoint Protection
• Endpoint Protection for Macintosh
• Endpoint Protection for Linux
• Mail Security for Microsoft Exchange
• Mail Security for Domino
• Messaging Gateway
• System Recovery Desktop Edition
• Web Gateway

 

would like to know which version below bundle with SEP12.1 ?

Symantec Protection Suite Enterprise Edition 3  &  4

 

 

In file connect you have find only latest SEPM 12.1 RU4 version.If you want to Old SEPM version you need to contact Symantec Customer support

https://symantec.flexnetoperations.com/control/symc/registeranonymouslicensetoken

 

if i see 12.1.1000.157 from add and remove program, that is SEPM 12.1 RU4 or not ? i can download it from Symantec Protection Suite Enterprise Edition 3 ? am i right ?

if i see 12.1.1000.157 from add and remove program, that is SEPM 12.1 RU4 or not ?

No it's SEP 12.1 RU1

You can contact Symantec support and download Link that version

 

got it i,m downloading version 12.1.4a , just wonder is there any support live chat in symantec, i saw the related link today but i wont be able to find it back

 

You can raised ticket for same

QuickStart Guide - Create and Manage Support Cases in SymWISE

http://www.symantec.com/docs/HOWTO31132

How to update a support case and upload diagnostic files with MySupport

http://www.symantec.com/docs/TECH71023

OR

Regional Support Telephone Numbers:

United States: https://support.broadcom.com (407-357-7600 from outside the United States)

Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)

United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/business/support/contact_techsupp_static.jsp

As I have delete sem5.db, I will be doing the disaster recovery below, if I have done below successfully, all the endpoint clients will be able to connected back to SEPM right ? Symantec Endpoint Protection 12.1: Best Practices for Disaster Recovery with the Symantec Endpoint Protection Manager

yes

what does the error message say? how many clients do you have in your network?

 

we have around 60 clients, accidently deleted sem5.db , and when i try to login to SEPM , below message pop up

 

Failed to connect to the server

make sure that the server is running and your session has not time out.

if you cna reach the server but can not log on, make sure that you provided the correct parameters

of you are experiencing network issue, contact your system administrator

 

i will follow below link to fix this, but need to wait for tomorrow evening as this is the mail system as well

http://www.symantec.com/docs/TECH160736

Please see this articles also because you have only 60 sep client.

Restoring client communications without a database backup

 

Article:HOWTO26639

|

Created: 2010-01-08

|

Updated: 2010-01-15

|

Article URL http://www.symantec.com/docs/HOWTO26639

 

Did you do the restore?

i did try to restore, but i got this problem (see attached screenshot) , it said the embedded database can not be started, as the sem5.db already removed, that embedded can not be started , any idea ?

You need to uninstall old sepm and reinstall new sepm and restore the database.

Please check this articles

Symantec Endpoint Protection Manager database backup and restore explained

https://www-secure.symantec.com/connect/articles/symantec-endpoint-protection-manager-database-backup-and-restore-explained

Hi All

 

i can not restore also from database backup in restore wizard (see attached screenshot) any solution ?

i got a restored sem5.db file, whick is a week ago old, i have tired to copy it back to the orginial path, but it seem doesnt work, any idea ?

after copied the sem5.db to the location, and i start the "symantec embedded database"

error pop up see attached screenshot

i found below err.log , the sem5.log is more recent than the sem5.db , because the sem5.db is from feb 9 , whereas the sem5.log is from 14 feb, i think i will try to restore the sem5.log from feb 9 , and copy sem5.log & sem5.db together back to the location and start the "symantec embedded database" service

 

02/15 13:08:01. Cannot open transaction log file -- Can't use log file "sem5.log" since it has been used more recently than the database file

Do you have follow below steps 1.If you had a catastrophic hardware failure, restore the server hardware using the IP address and host name from Backup.txt (from Step 3 above). 2.Reinstall Symantec Endpoint Protection Manager using a disaster recovery file (gathered in Step 2 above). When the Management Server Configuration Wizard runs, choose "Custom configuration" and "Use a recovery file". ( For Small Business Edition, if the folder does not exist, create the folder and place the recovery file there before installation. Location: <Install drive> \<Install folder>\Server Private Key Backup, Example: C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Server Private Key Backup) 3.Stop the following Services: Symantec Endpoint Protection Manager and Symantec Endpoint Protection Manager Webserver 4.Restore the database (Use the "Database Backup and Restore Wizard from the SEPM tools folder). Note that the recovery file should be used during the configuration of a new installation; if you use the recovery file to re-configure an existing installation, the Manager certificate can be restored but the existing default domain ID will not be changed unless you restore a database backup. Also, if you choose to configure the Manager as a replication partner, the default domain ID in the recovery file will be ignored and the Manager will use the domain ID(s) in the database of its replication partner

hi james

 

 

                ok let me try to remove the exisiting SEPM first and reinstall the SEPM, i did not remove the SEPM before, i think this is why it pop up for database not started, do you think i can simply copy the backup of sem5.log and sem5.db a week ago, and copy it to the orginal location, and then start the symantec emebbed service ?

You will have to reinstall SEPM & restore backup DB.

Take a backup of server private key folder also

It's not work, Try to run symantec configuration wizard and check if issue resolved Before starting the wizard juzt make sure you have the backup of recovery key from C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Server Private Key Backup

Before running the configuration wizard, I need to remove the SEPM right ? I realized my private key backup was on year 2011, if I restore that, the end point clients will not be update, I guess most of the end point clients will not be managed by SEPM after year 2011 many computer installed end point ? I need to manually remote push install for them ?

 

 I guess most of the end point clients will not be managed by SEPM after year 2011 many computer installed end point ? I need to manually remote push install for them ?

yes

What are the different between restoring from recovery file and database ? For database backup file is it located under backup folder in SEPM path with file format .zip

use client deployment wizard in latest version of SEPM if the clients become offline becuase of certificate mismatch.

Hi,

You should restore both i.e. database & recovery file to bring back SEPM to the original state.

If you do not have a database backup to restore:

You can perform a disaster recovery without a database backup, but the following points apply in this case:

• All policies must be re-created, or imported from other backups i.e. exported policy files.
• Clients will be able to communicate with the SEPM but will re-appear in the console only after their next check-in.
• Clients will reappear in the default group as they check in, unless you enable automatic creation of client groups on the re-installed SEPM by editing "scm.agent.groupcreation=true" to the conf.properties file. This file is located <drive>Program files or(x86)/Symantec/Symantec Endpoint Protection Manager/tomcat/etc.
• If you originally had multiple SEPM domains beyond the default domain, you must re-create them using domain IDs from Backup.txt.

Reference: http://www.symantec.com/docs/TECH160736

As my database backup is from 2011, do you suggest me too restore the database ? And for client will communicate back with SEPM for the next check in mean that client need to reboot their computer ?

Does your issue are resolved?

If your certificate mismatch you need to replace sylink.xml for each client.

I have resolved my problem by copying the sem5.log and sem5.db to the original state, from last week D2D backup, and I am able to start up the symantec emebbed sevice, thx so much for all your help !

Found out a problem, some of the end point client show offline and for those who show online the virus definition not update to date, how do I fix that ?

Does your sepm server are updated ?Try to replace sylink.xml which are client are showing offline ?

Now you have up and running SEPM, I would suggest you to take backup of all the policies.

http://www.symantec.com/business/support/index?page=content&id=TECH106486

uninstall sepm,

reintall fresh SEPM

create groups, 

import policy, 

use communication deployment wizard to bring your clients back..

http://www.symantec.com/business/support/index?page=content&id=TECH199124

will take max 1 hr to do the steps in mentioned for 60 clients :)

thanks for your reply, and just wonder if i deploy remote push for those who already has managed end point installed in the past, if i deploy the remote push again what will happen ? it will overwrite it ?

You dont have to push the package, just push the communication package that is Sylink.xml

, it will communicate with the new SEPM.

Even if you push a new package, it will overwrite the previous one. I dont think there is any harm in that.

how do i push sylink.xml ?  can i try that first as i do not want to uninstall the SEPM and reinstall this moment, and i also realized that the sem5.log is very large, and in the other SEPM server location in brand office, the sem5.log size is around 4mb, how i can make my sem5.log size small at all time ?

You can do it from the SEPM, see here on the steps:

Restoring client-server communications with Communication Update Package Deployment

i can not find below in client deployment wizard,

 

 

1. In the Client Deployment Wizard, click Communication Update Package Deployment, and then click Next.

Communication Update Package Deployment setting available only SEP 12.1.2 and higher version

You can use Sylink Replacer Tool

How to point clients to a new SEPM after decommissioning or replacing the primary SEPM.

 

Article:TECH92556

|

Created: 2009-01-24

|

Updated: 2012-06-21

|

Article URL http://www.symantec.com/docs/TECH92556

 

i think i do need to reinstall the SEPM as the client list show offline and sometime online and can not update the virus defintion, i have below concern

since the SEPM installed on mail server, i can not schedule a reboot during the day time, just wonder if i want to migrate the SEPM to another server, a fresh new install on other server, and uninstall the problem SEPM server, and to remote push end point to clients in the new SEPM server, is it possible to achieve that ?

　

　

Best Regards

Keith

Yes keith, possible thats the easiest method I have been suggesting,

Uninstall /installing of SEPM does not need a reboot

Install a new sepm, 12.1.4 ( thats the latest), 

use the migration and deployment wizard, get the clients to new sepm, once all set , remove the old sepm.

I believe you exported policy from old sepm, you can use that to the new sepm...

symantec endpoint protection manager has detected that there are pending system changes taht require a reboot, please reboot the system and rerun the installation,  

 

 i think that before the installation, i do need to reboot the server

 

Yes you can reboot SEPM server

this is a new installed SEPM, how come in left down corner window definitions show information is currently unavailable ?  and i can not perform the liveupdate , and my company is running a proxy server, do i need to setup the proxy server info inside SEPM ?

You can configure proxy setting as per below articles

How to Configure the Proxy settings in the Symantec Endpoint Protection Manager (SEPM) 12.1

https://www-secure.symantec.com/connect/articles/how-configure-proxy-settings-symantec-endpoint-protection-manager-sepm-121

yeah thats coz of proxy, you need to set that up for SEPM 

How to setup the Symantec Endpoint Protection Manager to use specific proxy settings for LiveUpdate

http://www.symantec.com/business/support/index?page=content&id=TECH102335

Latest on manager still showing information is currently unavailable and "symantec security Response" not showing anything, and virus and risks activity summary also, would like to know once the SEPM is deployed, the auto live update on SEPM is enable automatically ?

did you configure the sepm to go out thru the proxy first?

Either you have entered incorrect proxy setting or your firewall is blocking symantec website.

Whats the result when you try to access as per this document

How to determine whether your firewall is blocking LiveUpdate

http://www.symantec.com/business/support/index?page=content&id=TECH139451

Do you need more help here ?