Hello all , SEP 12 RU2 is running on couple of servers . Basically the issue being observed is that the client service stops automatically and we have to start it manually, once the service is started then on the next day it is again stopped automatically. Which logs do I need to look into that will identify which exact thing is causing the service to stop?

Secondly kindly also tell me auto-upgrading the clients require a reboot to make the changes ? or reboot is not mandatory to upgrade the version ?

Regards

Is that machine a GUP? seems like its a know issue.

The SMC.exe processes crashes on Symantec Endpoint Protection 12.1 RU4 when Group Update Provider functionality is enabled

http://www.symantec.com/business/support/index?page=content&id=TECH213461

ccSvcHst.exe intermittently crashes after updating Proactive Threat Protection content on January 19, 2015 content

http://www.symantec.com/business/support/index?page=content&id=TECH227716

Reboot is not mandatory if you are upgrading from 12.X to 12.1.5

its required if you doing upgrade from 11.x to 12.X as the SEP does a side by side install..

SEP 12.1 employs a side-by-side, replace on reboot installation strategy. Side-by-side means that new files are written to a new folder, referred to as a silo, isolated from the existing operational folder. Because the two versions are separated from each other, during a migration the older software is left running unchanged until the next reboot.

The primary benefit of side-by-side installation and replace on reboot is that the system continues to be protected by the existing software until the new version is in operation after the reboot.

This technique enables you to change the normal portion of the installation path during a migration, when applicable.   

Hi Rafeeq thanks for your reply. No its not a GUP . Its a Server OS machine running SEP 12 RU2 client.

Any specific logs I need to look into to determine what is causing the service to stop ?

Regards

Hi,

You should look into event viewer and sylink monitor logs. 

Reboot is necessary but you can configure custom settings. Without reboot upgraded version won't be functional becuase SEP 12.1 employs a side-by-side, replace on reboot installation strategy. Side-by-side means that new files are written to a new folder, referred to as a silo, isolated from the existing operational folder. Because the two versions are separated from each other, during a migration the older software is left running unchanged until the next reboot.

The primary benefit of side-by-side installation and replace on reboot is that the system continues to be protected by the existing software until the new version is in operation after the reboot.

 

Reboot is necessary though upgrade is from 12.1 RU2 to 12.1 RU5.

You may need to run the symhelp tool with advanced debugging turned on and open a support case.

Also, that version is old so you may want to test upgrading one client

Check event viewer.. We used to enable sylink and leave it run over night SMC would stop logging after crash.. The logs may get huge Let's start with event viewer

Well we can do the upgrade but as these are server machines , running buisness applications so rebooting them is not possible so thats why I asked to confirm if the reboot is mandatory or not to make the changes  take effect.

Regards

Reboot is necessary but can plan during non production hours. :) 

thanks for the reply chetan. One last thing is  there any way we can re-cycle SEPM and SEPM web service via commands in CMD ? regards

You can use WMiC to stop / start a service,

http://www.tech-recipes.com/rx/2949/windows_use_wmic_start_stop_service_command_line/

Check this article: https://www-secure.symantec.com/connect/articles/sep-121-dos-commands

Is there any update?

Or

If your query has been resolved mark this thread as a solved with the best answer that helps you.