Endpoint Protection

Symantec Endpoint Prtection Manager has a facility to send Scheduled Reort to a desired email ID(s) on a set frequency. We have scheduled the daily SEPM health status report to be sent to couple of email IDs.

When we check the SEPM, it shows the email has been sent. The date and time also gets updated. So it looks like the system send the email.

However, none of the receipient receives the email.

We have cross checked the email server settings as well. Thing seems to be alright. However, there seems to be some mistake.

In this regard, please anwer....

#1. Is there anything that needs to be enable/set, in order to receive those daily report.

#2. Where can we find the LOG entry for this "Schedule Report Sending" activity? That may have some answer.

i have the same configuration but working for me. we are using domino 7.0.2 & mailmarshal for mail filtering with no policy define for symantec .

Please check whether the communication between the SEP server mail server is perfect or not because there is no such special configuration needed in SEP for mailing notifications.

Spam Filtering has nothing to do with the reports. No ways it can prevent the mails from being delivered.

Spam filtering may play an important role in this case. Please check the spam settings as it may declare those mails as spams. Advice you to check the spam folder also.

samiron, no there is no spam filtering & there is no spam filtering system in your network.

hi,
where in SEPM do you see "When we check the SEPM, it shows the email has been sent." ? did you check the SEPM report /monitor log?

you may need to check the sniffer logs to see if at all it can send a mail to mailserver?

Pete!

Hi Pete

We see it in reports section.

Where can I see sniffer logs.

Tejas
 

Hello Tejas,
I was talking to run the sniffer tool on the SEPM/Mail server to see if the mail is being hot on the mail server. This is to test if the mail is sent  from SMTP, then verify if that hits the mail server!

Pete!

Some issues with the reports over emails were resolved in the latest release, eventually upgrade your SEPM.

Where can I find which version I use...

Help --> About shows the following....






And Help --> Trouble shooting -- Versions shows following....




Tejas

You have the latest Major Release, MR4, 11.0.4000, it should be good.
Here you can check if the MR4 MP1 (11.0.4014) has some fixes for your issue:

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121216360648

I can not find, how easily i can upgrade. If it's not easy then no one would rather upgrade, as he is already on MR4.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121216494948?Open&docid=2007121216360648&nsf=ent-security.nsf&view=docid

Hi Tejas, but still I think SEP should still send the reports. Do you host the mail server and check emails logs to verify if SEPM is connecting to your mail server?

We are using Google Apps as a mail server. We do not have in-house mail server like, MS exchange or Lotus notes.

Ok, what mail server settings did you use? If Im not mistaken, google is using a different port for smtp.

Google's default email settings....

pop.gmail.com
smtp.gmail.com

Google needs some port settings to be chages for outgoing email server, We have tried both, default and what google recommands.

In neither of cases, the email fires.

Yes I remember google is using SSL, not sure if SEPM can send thru this.

Hi paul, here are the screen shots of the settings....

When we check the SEPM, it shows the email has been sent



The date and time changes on a daily basis, so we can say SEPM is trying to send the email.

Tejas

As mentioned earlier, the here ar eour mail server settings...



This is also not an error.

So where does the emails go? This happens on some other site as well?

So it looks like there is one common mistake we are making. Iand I am struggling to find that mistake.

Tejas

On the logs is it sending?

Can you try to send a test email notification?

Send out a Notification would be to create an notification condition for "Authentication Failure".

1. Change Occurrences to 1

2. Add email address to sent out to

3. Log out then enter incorrect credentials on the SEPM A notification will now be generated, check for email sent.

Hi Tejas,

By the screen shot it only mentions that policy has run, but cannot confirm if the mail has been sent to the end user. With that timestamp you can check the bottom pane to see if the mail was sent successfully or not!!

 

Pete!

Where can we find the LOG entry for this "Schedule Report Sending" activity? That may have some answer.

Where can we find the LOG entry for this "Schedule Report Sending" activity? That may have some answer.

Where can we find the LOG entry for this "Schedule Report Sending" activity? That may have some answer.

Did you try a test with yahoo mail?. Try using a Yahoo account, set to smtp.mail.yahoo.com port 25.
Dont forget to add the email ddress in the "Notification condition".

Let me know how it goes.

Thomas

I'm having the same problem with our system.  I've tried using our own mail servers, as well as trying ones with yahoo and google.  The server logs show this...
Event type: An unexpected exception has occurred
Event description: Email sending failed
Error message: Email sending failed.
Error code: Email sending failed.

Stack trace: javax.mail.SendFailedException: Sending failed; nested exception is: class javax.mail.MessagingException: Could not connect to SMTP host: mailhost.engr.uconn.edu, port: 225; nested exception is: java.net.ConnectException: Connection timed out: connect at javax.mail.Transport.send0(Transport.java:218) at javax.mail.Transport.send(Transport.java:80) at com.sygate.scm.server.util.MailUtil.sendMail(MailUtil.java:264) at com.sygate.scm.server.task.ScheduledReportingTask.mailIt(ScheduledReportingTask.java:250) at com.sygate.scm.server.task.ScheduledReportingTask.generateReport(ScheduledReportingTask.java:191) at com.sygate.scm.server.task.ScheduledReportingTask.run(ScheduledReportingTask.java:138) at java.util.TimerThread.mainLoop(Timer.java:512) at java.util.TimerThread.run(Timer.java:462) com.sygate.scm.server.util.ServerException: Email sending failed at com.sygate.scm.server.util.MailUtil.sendMail(MailUtil.java:266) at com.sygate.scm.server.task.ScheduledReportingTask.mailIt(ScheduledReportingTask.java:250) at com.sygate.scm.server.task.ScheduledReportingTask.generateReport(ScheduledReportingTask.java:191) at com.sygate.scm.server.task.ScheduledReportingTask.run(ScheduledReportingTask.java:138) at java.util.TimerThread.mainLoop(Timer.java:512) at java.util.TimerThread.run(Timer.java:462)

Site: Carbon
Server: carbon
Date: 06/11/2009 10:16:52
Severity: Warning

Results with google and yahoo are the same, with the different port numbers, and I've tried doing the same with our Exchange server, again with the same effect

Do you have a proxy?

have anyone ever got it working with gmail or yahoo?