Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SEMWEBSRV Service generating huge traffic

Created: 30 Sep 2012 | 16 comments
Ramji Iyyer's picture

When started the SEMWEBSRV services the latence time increases to 2430 ms

SEMWEBSRV Service generating huge traffic. SEPM Service is also stopped. Giving Event id 4096 Java -1 error in event viewer, SEPM service will not stay in started state. Failed to connect to server message during login to SEPM

Comments 16 CommentsJump to latest comment

Ashish-Sharma's picture

Event ID 4096 - "Java -1" error in event log and error "Failed to connect to server" at Login on a Windows 2003 SP2

http://www.symantec.com/business/support/index?page=content&id=TECH98311

Event id 4096 Java -1 error in event viewer, SEPM service will not stay in started state. "Failed to connect to server" message during login to SEPM.

http://www.symantec.com/business/support/index?page=content&id=TECH181655

Thanks In Advance

Ashish Sharma

 

 

Ramji Iyyer's picture

I came to know about the bug in SEP 12.1 RU1 MP1 about this issue & there is some registry tweaking for this which fixes this issue.

Do any one know this registry key fix?

Regards...
Ramji Iyyer

Ramji Iyyer's picture

Not worked for me

Regards...
Ramji Iyyer

Ashish-Sharma's picture

can you pass on the scm-server-0.log from the tomcat\logs folder of SEPM?

Edit ###

Also Try this

Tuning the Performance of the Symantec Endpoint Protection Manager console

http://www.symantec.com/docs/TECH105179

Thanks In Advance

Ashish Sharma

 

 

Chetan Savade's picture

Hi,

Could you please provide the following details?

1) SEPM version

2) Operating System details

3) Have you done any changes in SEPM, OS? Since facing this issue?

4) How did you identified SEMWEBSRV Service generating huge traffic

Please provide scm-server-0 & Catalina.out logs, both will be present under tomcat\logs.

Could you please provide the event id Screenshot.

 

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

Ramji Iyyer's picture

Hi CHetan, How are you ???

1) SEPM version

SEPM 12.1 RU1MP1 ( 12.1.1101.401)

2) Operating System details

Windows 2003 ENT 32 bit with SP2

3) Have you done any changes in SEPM, OS? Since facing this issue?

No Changes in OS

4) How did you identified SEMWEBSRV Service generating huge traffic

When we Stop the SEMWEBSRV service the ping response of the server decreases & is stable at 1ms
When we start the service latency increases to 1000 ms to 2300 ms &.SEPM Service get stopped

 

 

AttachmentSize
Server issue.zip 257.55 KB

Regards...
Ramji Iyyer

Ramji Iyyer's picture

Additinal information

We are using SQL 2005 with SP4 on a separate box.

Regards...
Ramji Iyyer

Chetan Savade's picture

Hi,

I am good & thanks for an update.

Could you please attach SST logs to this thread?

Here is the location of the Symantec Endpoint Protection Support Tool:

http://www.symantec.com/business/support/index?pag...

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

Ashish-Sharma's picture
SiteId: null
ServerId: A66976190A30025800213B6EE26DC02D
SystemEventId: 1281
EventDesc: Unexpected server error.
MessageId: 1
ErrorCode: 268500992
com.sygate.scm.server.util.ScmServerError: Failed to connect to database after tried 20 times, please start the database!
 
The sem5.log may be corrupted.
 
Try to follow the steps from Article: http://www.symantec.com/docs/TECH178718

If the procedure above does not work, perform a disaster recovery:

Symantec Endpoint Protection 11.x: Best Practices for Disaster Recovery with the Symantec Endpoint Protection Manager

http://www.symantec.com/business/support/index?page=content&id=TECH102333

Check this as well:

https://www-secure.symantec.com/connect/forums/failed-connect-server-22

 

Thanks In Advance

Ashish Sharma

 

 

Ramji Iyyer's picture

We are using SQL 2005 with SP4

Regards...
Ramji Iyyer

Ashish-Sharma's picture

Your SEPM is unable to connect to the database. Try running a repair on SEPM, if still no success

Please perform DR:-

Symantec Endpoint Protection 11.x: Best Practices for Disaster Recovery with the Symantec Endpoint Protection Manager

http://www.symantec.com/business/support/index?page=content&id=TECH102333

Thanks In Advance

Ashish Sharma

 

 

Swapnil khare's picture

Open Server.xml , open in notepad , change port from 8005 to 8006 and check .

Location :-  <Install Dir>\Tomcat\conf\server.xml

make sure to create alternate copy of xml before making changes to it ,

Once port is changed try restarting the service might work .

 

Run the dbvalidator to check if DB is still working :\program files\Symantec\Symantec endpoint protection manager\tools

If still its not working then ..check if you have another application that uses Sybase ( adaptive server anywhere ) database ..is there any other process for dbsrv ie semsrv ?

 

Caused by: java.sql.SQLException: Network error IOException: Connection refused: connect

solution

https://cgsrv1.arrc.csiro.au/blog/2010/05/24/java-sql-sqlexception-network-error-ioexception-connection-refused-connect-sql-express/

 

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

 

Ramji Iyyer's picture

DBValidator is passed.

Regards...
Ramji Iyyer

Swapnil khare's picture

Please check port 1433 and re run management server configuration wizard.

Please upload SST as Chetan suggested

 

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

 

A. Wesker's picture

Hi Ramji,

 

Even if you didn'nt perform some changes on anything, I would recommend you to follow the instructions and checkpoints of the KB article below.

=> http://www.symantec.com/business/support/index?pag...

Ensure at the same occasion if you have enough disk space on your machine where the SEPM is installed and ensure the memory allocated to all the database tables used by SEP didn't reach their limits on your SQL Server as well. You will recognize them easily as they're all displayed when you click to sem5 main table (sem5_db, sem5_content, sem5_logs, etc ...).

Keep us updated about the tests results and check points mentioned on the KB and the other check points mentioned.

 

Kind Regards,

A. Wesker