Hi.

I am experiencing some unexpected errors with my SEPM rig after upgrading to the last version.

Upgrade went fine but clients are now unable to connect.

The Management Console, however, connects just fine.

Version is SEPM 12.1.5337.5000.

scm-server-0.log says:

...

2014-10-19 17:45:05.841 THREAD 12 SEVERE: Schedule is started!
2014-10-19 17:45:05.857 THREAD 35 SEVERE: Your hard disk space is less than <512>MB. Symantec Endpoint Protection Manager requires more disk space to complete certain tasks. Please delete some files to free up some space. Symantec recommends that you have a minimum of 1GB of free disk space.
2014-10-19 17:45:05.872 THREAD 35 SEVERE: Disk space below critical, Updating server health
2014-10-19 17:45:05.950 THREAD 12 SEVERE: StartupServlet> startServer>> SEPM Service started.
2014-10-19 17:45:05.982 THREAD 35 SEVERE: Stop ClientTransport.
2014-10-19 17:45:05.982 THREAD 35 SEVERE: There is not enough disk space, Stopping Client Transportion.

PackagePublisherTask-0.log:

2014-10-19 17:45:07.762 THREAD 31 WARNING: PackageTask: There is not enough disk space! Skip this time!

DeltaPackageTask-0.log:

2014-10-19 17:45:13.991 THREAD 41 WARNING: DeltaPackageTask: There is not enough disk space! Skip this time!

ContentMergeTask-0.log:

2014-10-19 17:45:13.991 THREAD 41 WARNING: ContentMergeTask: There is not enough disk space! Skip this time!

There is 44GB free on drive C: and 27GB free on drive D: (where agent "data" folder is located)

Server is listening, but not responding, to port 8014.

Server has been restarted multiple times without any change.

Clues, anyone?

Regards,

Magnus

Advice on how to remove the red, dotted line surrounding my post would also be great.

Is this some kind of an over-agressive anti spam functionality?

Regards,

Magnus

How many content defs are you keeping. You should have at least twice the size of free space available. I ran into this same issue for this upgrade

Hi.

I tried fiddling with the scm.lucontentcleanup.threshold to no avail.

Anyways: SEPM claiming there is less than 512MB available disk spaces seems a bit off when there is 45+/25+ GB available?

If someone at Symantec reads this: it would be nice if the error message contained information on which drive is low on space.

Regards,

Magnus

Reduce the content revision

How to free up disk space on a Symantec Endpoint Protection Manager server

Disk Space Management procedures for the Symantec Endpoint Protection Manager

Low Disk Space issues encountered on systems running Symantec Endpoint Protection

Hi again, .Brian.

Just to be clear: you write "you should have at least twice the size of free space". Are you suggesting there should be at least 90GB free on C: and 50 on D: in order for SEPM to work?

Regards,

Magnus

You need to make sure you have enough free space on the drive you're installing SEPM. Whether it be C or D

While this article doesn't make mention of the logs you've posted, the scenario sounds similar:
http://www.symantec.com/docs/TECH196326

Please try reinstalling the LiveUpdate Client on the SEPM and reregistering the SEPM with it:
http://www.symantec.com/docs/TECH171060

I just upgraded to scm.server.version = 12.1.5337.5000 and having the exact same problem.

36 GB on C: and 451GB on D FREE !!!

What gives?

I have wasted many hours looking into network issues.

All fixes listed here have been tried and are useless.

Please help !!!!!

Hi, SMLatCST.

Thank you very much for your suggestions.

I am not seeing the LiveUpdate error in your reference.

When running LiveUpdate manually, content is downloaded and everything look just fine.

LiveUpdate is version 3.3.100.15.

LiveUpdateTask-0.log does, however, logs "There is not enough disk space."

lucatalog.exe -cleanup

lucatalog.exe -forcedupdate

then running luall.exe

does not change anything - virus definitions download just fine.

Using ProcMon I find that SemSvc.exe periodically calls QueryFullSizeInformationVolume for c:\ and gets

TotalAllocationUnits: 17 745 800
CallerAvailableAllocationUnits: 12 274 824
ActualAvailableAllocationUnits: 12 274 824
SectorsPerAllocationUnit: 8
BytesPerSector: 512
 

Seems fine, so I really can't figure out why SEPM is not happy...

After the query, SemSvc.exe writes "There is not enough disk space!" to the different logs mentioned initially.

Magnus

Hi, cooldude.

Thanks for your links.

The problem is, however, no that SEPM is running out of disk space.

The problem is that SEPM thinks it's running out of disk space.

Regards,

Magnus

I expanded the C volume to 200GB with 164 now free and after a reboot, I still get the disk space error.

A

In that case (and assuming you've tried the whole remove/reinstall LU client) I can only suggest a repair, followed by a DR restore if that doesn't work.

I've not encountered this myself, nor could I find an article on it earlier, so a Support case would defnitely be recommended at this point!

Are there any indicative errors in the SesmLu.log?

Well...I spent the day on the phone with support and we uninstalled the SEPM, did a cleanwipe of SEPM, reinstalled to the D: drive, restored the database....many combinations and iterations and were eventually able to get the SEPM working.

As this is a vm....I went to a backup from before support was called.

The REAL solution.....simply change the properties of the SEPM and SEPM Webserver services to logon as local account.

Reboot and SEPM started populating...no disk issue to stop clients from connecting.

Hope this helps you :)

Al

Have you tried to restart the server and database service?

Hi, Jodal00.

Thanks a lot for pointing me in the right direction!

Network Service runs both services on this rig.

In ProcMon I see that SemSvc.exe does periodic QueryOpens on D:\ resulting in ACCESS_DENIED. A bit annoying that I did not see those earlier :-)

I have no clue why SemSvc.exe wants access to D:\ - SEPM data is located at D:\SEPM\Data, where Network Service has change access.

Granting read (this folder only) on D:\ to Network Service makes SEPM happy and clients connect again.

ACL now looks like this:

d:\ BUILTIN\Administrators:(OI)(CI)F
    CREATOR OWNER:(OI)(CI)(IO)F
    NT AUTHORITY\NETWORK SERVICE:(special access:)
                                 READ_CONTROL
                                 SYNCHRONIZE
                                 FILE_GENERIC_READ
                                 FILE_READ_DATA
                                 FILE_READ_EA
                                 FILE_READ_ATTRIBUTES

    NT AUTHORITY\SYSTEM:(OI)(CI)F

I have not tested with stricter access control.

Some feeback from Symantec on actual rights needed - and perhaps an explanation on why root level disk access is suddenly needed - would be nice.

I also strongly suggest that log entry detail is beefed up a bit so that the log messages actually make sense, as in "unable to access d:\ for <whatever purpose>" instead of "There is not enough disk space!"

Regards,

Magnus

Thanks Jodal00

Same solution for me.  Upgraded from 11.X to 12.1.5 and got an issue with Web services not starting.  Changed it to local system account and started fine.  Then I found the 512Meg error in SEPM.  Changed the SEPM service to local system account also and fixed issue.

Thanks for posting.

G