Endpoint Protection

I am running SEP 11.0.6005.562. The server is giving me an error message of 'An unexpected exception has occurred' and is labled as severe. I am not sure what is happening. Here is a sample of the scm-server-0.log:

2011-01-27 11:02:12.290 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
 at com.sygate.scm.util.XPathSchemaUtil.xpath(XPathSchemaUtil.java:98)
 at com.sygate.scm.util.XPathSchemaUtil.xpath(XPathSchemaUtil.java:63)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getValue(AvPolicyCompiler.java:3739)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getValue(AvPolicyCompiler.java:3728)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getMacroVirusAction(AvPolicyCompiler.java:3226)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getAPActions(AvPolicyCompiler.java:3211)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getAVCommandScan(AvPolicyCompiler.java:2619)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getAVCommandScanOptions(AvPolicyCompiler.java:1881)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getAVCommandScanOptionsLink(AvPolicyCompiler.java:410)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.compile(AvPolicyCompiler.java:209)
 at com.sygate.scm.server.publisher.compiler.Spa50ProfileCompiler.buildAVPolicy(Spa50ProfileCompiler.java:1005)
 at com.sygate.scm.server.publisher.compiler.Spa50ProfileCompiler.compile(Spa50ProfileCompiler.java:823)
 at com.sygate.scm.server.task.PackageTask.updateProfile(PackageTask.java:1045)
 at com.sygate.scm.server.task.PackageTask.updateGroup(PackageTask.java:992)
 at com.sygate.scm.server.task.PackageTask.getChildGroups(PackageTask.java:1213)
 at com.sygate.scm.server.task.PackageTask.checkGroupDirectory(PackageTask.java:902)
 at com.sygate.scm.server.task.PackageTask.run(PackageTask.java:305)
 at java.util.TimerThread.mainLoop(Timer.java:512)
 at java.util.TimerThread.run(Timer.java:462)
2011-01-27 11:02:40.414 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
 at com.sygate.scm.util.XPathSchemaUtil.xpath(XPathSchemaUtil.java:98)
 at com.sygate.scm.util.XPathSchemaUtil.xpath(XPathSchemaUtil.java:63)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getValue(AvPolicyCompiler.java:3739)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getValue(AvPolicyCompiler.java:3728)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getMacroVirusAction(AvPolicyCompiler.java:3226)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getAPActions(AvPolicyCompiler.java:3211)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getAVCommandScan(AvPolicyCompiler.java:2619)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getAVCommandScanOptions(AvPolicyCompiler.java:1881)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getAVCommandScanOptionsLink(AvPolicyCompiler.java:410)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.compile(AvPolicyCompiler.java:209)
 at com.sygate.scm.server.publisher.compiler.Spa50ProfileCompiler.buildAVPolicy(Spa50ProfileCompiler.java:1005)
 at com.sygate.scm.server.publisher.compiler.Spa50ProfileCompiler.compile(Spa50ProfileCompiler.java:823)
 at com.sygate.scm.server.task.PackageTask.updateProfile(PackageTask.java:1045)
 at com.sygate.scm.server.task.PackageTask.updateGroup(PackageTask.java:992)
 at com.sygate.scm.server.task.PackageTask.getChildGroups(PackageTask.java:1213)
 at com.sygate.scm.server.task.PackageTask.checkGroupDirectory(PackageTask.java:902)
 at com.sygate.scm.server.task.PackageTask.run(PackageTask.java:305)
 at java.util.TimerThread.mainLoop(Timer.java:512)
 at java.util.TimerThread.run(Timer.java:462)
2011-01-27 11:03:12.336 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-27 11:03:45.275 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-27 11:04:19.292 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-27 11:04:51.699 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-27 11:05:22.715 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-27 11:05:59.046 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-27 11:06:30.985 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-27 11:07:04.220 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-27 11:07:36.612 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException

Any info on whats going on and how to resolve this issue would be appreciated!

Reboot the server. I have seen this getting resolved by rebooting.

Ok, I will try that first. Thanks!

Rebooting did help some what. All of the client groups that I have are getting updated virus definitions now except for one group. I am still getting the same type of error in the log:

2011-01-28 12:50:22.375 SEVERE: ================== StartClientTransport ===================
2011-01-28 12:50:23.500 SEVERE: Schedule is started!
2011-01-28 12:53:07.925 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
 at com.sygate.scm.util.XPathSchemaUtil.xpath(XPathSchemaUtil.java:98)
 at com.sygate.scm.util.XPathSchemaUtil.xpath(XPathSchemaUtil.java:63)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getValue(AvPolicyCompiler.java:3739)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getValue(AvPolicyCompiler.java:3728)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getMacroVirusAction(AvPolicyCompiler.java:3226)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getAPActions(AvPolicyCompiler.java:3211)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getAVCommandScan(AvPolicyCompiler.java:2619)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getAVCommandScanOptions(AvPolicyCompiler.java:1881)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.getAVCommandScanOptionsLink(AvPolicyCompiler.java:410)
 at com.sygate.scm.server.publisher.compiler.logicaobject.AvPolicyCompiler.compile(AvPolicyCompiler.java:209)
 at com.sygate.scm.server.publisher.compiler.Spa50ProfileCompiler.buildAVPolicy(Spa50ProfileCompiler.java:1005)
 at com.sygate.scm.server.publisher.compiler.Spa50ProfileCompiler.compile(Spa50ProfileCompiler.java:823)
 at com.sygate.scm.server.task.PackageTask.updateProfile(PackageTask.java:1045)
 at com.sygate.scm.server.task.PackageTask.updateGroup(PackageTask.java:992)
 at com.sygate.scm.server.task.PackageTask.getChildGroups(PackageTask.java:1213)
 at com.sygate.scm.server.task.PackageTask.checkGroupDirectory(PackageTask.java:902)
 at com.sygate.scm.server.task.PackageTask.run(PackageTask.java:305)
 at java.util.TimerThread.mainLoop(Timer.java:512)
 at java.util.TimerThread.run(Timer.java:462)
2011-01-28 12:53:40.821 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-28 12:54:13.466 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-28 12:54:45.783 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-28 12:55:18.444 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-28 12:55:51.544 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-28 12:56:24.818 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-28 12:56:56.467 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException
2011-01-28 12:57:28.084 SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException

What is the  version you  are running? Install the latest version and then see, if you get those  entreis in the  logs......I don't think, the group not updating  has anything  to do with Unexpected  error" messages...You can check the  liveupdate  policy  for that  group and  see...( better, if you open a new  post for that issue)

I am running SEP 11.0.6005.562

I downloaded the latest version of SEP from the license portal. I fixed the clients that were not updating by replacing the live update policy with another one that I copied from a different policy.

That's great!!! So do we have a  Solution???

So it sounds like different policies were applied?

No, a different policy was not applied. I didn't modify the Live Update policy but I did modify the AV and Antivirus policy. The only thing modified was the checkbox for 'Delete newly created infected files if the action is Leave Alone (log only). I can only assume that the policy became corrupted somehow.

did you delete any package assigned to the group? or in sepm console??

I deleted a packeage in the management console but it was not assigned to any group.

seems like you need to re-add the package..

It was not used by any group so re-adding it wouldn't fix the issue in my opinion.

long back had same issue, not able to get that link, just re-add the package, if does not work we can delete it, :) 

@ Mykul, See this KB that mentions the same error that you are experiencing.

"Unknown Exception" error seen upon logging in to the Symantec Endpoint Protection Manager -

http://www.symantec.com/business/support/index?page=content&id=TECH98126&actp=search&viewlocale=en_US&searchid=1296581674530

Best,

Thomas

Cycletech,

Thanks, I will take a look at it.

I too had the repeated:

SEVERE: Unknown Exception in: com.sygate.scm.server.task.PackageTask
java.lang.NullPointerException 

in scm-server-0.log

Some groups would not update virus definitions and the Policy Serial Number + Policy Date remained unchanged despite recent policy changes. If I created new groups they would have no Policy Serial Number and no Policy Date and they also would not show up as hexadecimal folders in "C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\outbox\agent" (the groups in question also would not change modified date in this folder).

I tried everything else and ended up with:

Stopping services (Symantec Endpoint Manager and Symantec Embedded Database) and restoring the "C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\db" folder to a point in time before the last "Policy Date" on the groups in question (although dbvalidator said the old db was ok).

After that everything worked again.

Since it was also complaing about two old Symantec Installation Packages (hard to find the media for those old versions) I also had to import those two old installation packages and delete them again (import form the SEPM\Packages folder on the installation media and point to the SAV32.info file and name it "Symantec Endpoint Protection version 11.0.2010.25 for WIN32BIT" which name can also be found by opening the SAV32.info file in Notepad)