Endpoint SWAT: Protect the Endpoint Community

 View Only
  • 1.  SEP Manager service keeps stopping (12.1.4 MP1b)

    Posted Sep 22, 2014 09:44 AM

    Just something that's cropped up lately and luckily only seems to be on one of my own SEPM's and not a customer's, is that the Symantec Endpoint Protection Manager service keeps stopping.  The 2008 R2 event logs are pretty straightforward on what's happening.  So the scenario is that I reboot the server to get a clean start, and the service tries to start, then immediately stops.  Here's the event log text, note the mention of Java Virtual Machine in STEP 2.:

     

    STEP 1: Service starts

    Log Name:      Application
    Source:        semsrv
    Date:          9/22/2014 9:29:53 AM
    Event ID:      4
    Task Category: None
    Level:         Information
    Keywords:      Classic
    User:          N/A
    Computer:      COMPUTER
    Description:
    Symantec Endpoint Protect Manager is starting in response to a 'start' request from the Service Control Manager. This is an informational message only. No user action is required.
     

    STEP 2: Service errors out:

    Log Name:      Application
    Source:        semsrv
    Date:          9/22/2014 9:30:18 AM
    Event ID:      4096
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      COMPUTER
    Description:
    The Java Virtual Machine has exited with a code of -1, the service is being stopped.
     

    STEP 3: service intentionally stopped during error process

    Log Name:      Application
    Source:        semsrv
    Date:          9/22/2014 9:30:18 AM
    Event ID:      5
    Task Category: None
    Level:         Information
    Keywords:      Classic
    User:          N/A
    Computer:      COMPUTER
    Description:
    Symantec Endpoint Protect Manager is terminating in response to a 'stop' request from the Service Control Manager. This is an informational message only. No user action is required.
     

    This SEPM is currently at the latest Java with update 67.  I reinstalled Java (overlay install), no change to this problem.  This issue has been off and on on various internal test SEPM'S for a very long time though, so I am not inclined to accept that it is purely because for example this update is too new or something, although that may still be the current explanation.

    But I do recall seeing some kind of article once in the past that said that a newer release fo Java was not supported and that caused issues with SEPM...could it just be that SEP team hasn't really addressed that problem since it first began?

     

    Thanks for any input or help.



  • 2.  RE: SEP Manager service keeps stopping (12.1.4 MP1b)

    Posted Sep 22, 2014 09:51 AM

    There's a bunch of articles on this, not sure if they apply to you though. Have you turned on advanced deubgging? You can post the scm-server.log file for review if needed.

    How to debug the Symantec Endpoint Protection Manager

    May want to also run symhelp on it to see what it reveals.

     



  • 3.  RE: SEP Manager service keeps stopping (12.1.4 MP1b)

    Posted Sep 22, 2014 10:22 AM

    post the scm-server0.log? should be port conflict 

    do a nestat -ano and see who is using 9090, 8443



  • 4.  RE: SEP Manager service keeps stopping (12.1.4 MP1b)

    Posted Sep 22, 2014 11:53 AM

    Actually since RU5 just came out I will update to that first and monitor the situation, taking into account your suggestins.  FWIW just prior to downloading RU5, I did re-install SEPM (12.1.4MP1b) and at least for the past few hours, no service restarts.  But either way I will update to RU5 since I need to get that tested before customer deployment. 

    I'll come back to this thread if the service issue starts again - you're right there were articles in the past, I didn't research them now but I do remember reading some and there never being a single solution (or one that worked for me).  I'd have ot revisit the subject again if I were to tackle this but who knows, maybe RU5 is enough of a refresher to fix things :)