Endpoint Protection

Almost weekly the SEPM Database is stopping. We are running SEPM version 12.1.6 (12. RU6) build 6168. I have to restart it and then it works for about a week. When I do restart it, it will take some time and say that it was not able to start due to taking to long, but it does restart. Below are the log files. What can be done? I have reinstalled this several times using Symantec support people and I do not want to go trough tat again. Other than this ongoing restart of the Embedded Database Server, everything is working fine. Also, there is 22GB of free space on C drive, so that should not be an issue.

06/08 21:05:59. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
06/08 21:06:04. Fatal error:  Internal error.
06/12 21:16:59. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
06/12 21:17:07. Fatal error:  Internal error.
06/14 21:05:26. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
06/14 21:05:38. Fatal error:  Internal error.
06/20 21:05:43. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
06/20 21:05:51. Fatal error:  Internal error.
06/28 21:05:54. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
06/28 21:06:01. Fatal error:  Internal error.
07/06 21:35:25. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
07/06 21:35:30. Fatal error:  Internal error.
07/14 21:05:22. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
07/14 21:05:36. Fatal error:  Internal error.
07/15 09:50:40. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
07/15 09:50:47. Fatal error:  Internal error.
07/18 21:18:13. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.db" failed with error code: (1784)
07/18 21:18:17. Fatal error:  Internal error.
07/21 07:30:34. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
07/21 07:30:48. Fatal error:  Internal error.
07/22 21:18:22. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
07/22 21:18:37. Fatal error:  Internal error.
08/03 21:05:26. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
08/03 21:05:33. Fatal error:  Internal error.
08/06 21:05:33. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
08/06 21:05:39. Fatal error:  Internal error.
08/11 21:05:28. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
08/11 21:05:37. Fatal error:  Internal error.
08/18 21:05:40. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
08/18 21:05:48. Fatal error:  Internal error.
08/25 21:05:34. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
08/25 21:05:40. Fatal error:  Internal error.
08/27 21:05:23. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
08/27 21:05:27. Fatal error:  Internal error.
 

Can you enable FINEST log level and post the new log here:

How to debug the Symantec Endpoint Protection Manager

http://www.symantec.com/docs/TECH102413

Also, please run the symhelp tool on it to do error checking.

just try this and let us know. rename the existing sem5.log to sem5.log.old and try to start the database service and then start the SEPM services

Ok, I have enabled the FINEST log level and will post new logs. I have previously done the renaming of existing sem5.log back on Aug 28th and it was no help. I will do this again and let you know.

What or where is the symhelp tool?

I did set in the properties of the Symantec Embedded Database service to restart if it fails, I will see if that helps.

symhelp found at this link:

Download the Symantec Help (SymHelp) diagnostic tool to detect Symantec product issues

Done.

Ran the tool, tried to attach the file and get this:

The selected file [xxxxx] 2015-10-22__14-47-21.sdbz could not be uploaded. Only files with the following extensions are allowed: 7z avi bz2 doc docx flv gif gz jar jpeg jpg md5 mov mp3 mp4 mpeg mpg odp ods odt package pdf png pps ppsx ppt pptx rar tar tgz txt wmv xls xlsx xml zip.

Really??!!

Ran your tool that produced your file and can't attach on your website???

Here it is zipped...

Attachment(s)

[BADGER]__2015-10-22__14-47-21.zip   8.17 MB 1 version

Should I wait and run this again later since I renamed the log file?

Do you ahve the scm-server-0.log file?

The symhep file doesn't show much in the way of issues.

Ideally, you'd want to enable the FINEST logging level, reproduce the issue, then disable FINEST as it will generate a ton of info.

Here is the scm-server-0 file.

As to "reproducing" the issue, it is random and I don't know what causes it, so I can't reproduce it. It happens almost every week, but no way to tell when exactly. Should I turn off the "FINEST" logging level and change back to "WARNING"?

Attachment(s)

scm-server-0_60.zip   132 KB 1 version

Yea, go back to the default as the logging size will go up quickly.

The database went down twice over the weekend. I am attaching latest log files-there were two in the "tomcat-logs" file, scm-server-0.log and scm-server-1.log

Attachment(s)

10-26 logs.zip   579 KB 1 version

Now the SEPM database is stuck on "starting' I tried rebooting and it is still hung at starting. I can't stop or restart it. The db size is now over 3.5 GB. Help!

10/22 00:00:40. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
10/22 00:00:50. Fatal error:  Internal error.
10/24 00:00:39. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.log" failed with error code: (1784)
10/24 00:00:44. Fatal error:  Internal error.
10/26 00:00:35. Fatal error:  A disk write to file "D:\SEPM 12.1.6\db\sem5.db" failed with error code: (1784)
10/26 00:00:37. Fatal error:  Internal error.
10/26 07:04:29. *** ERROR *** Assertion failed: 100904 (16.0.0.1324)
Failed to redo a database operation (id=4, page_no=0x3a, offset=0x17bc) - Error: Cannot access file 'D:\SEPM 12.1.6\data\inbox\log\traffic\CE10E82
10/26 08:14:09. *** ERROR *** Assertion failed: 100904 (16.0.0.1324)
Failed to redo a database operation (id=4, page_no=0x3a, offset=0x17bc) - Error: Cannot access file 'D:\SEPM 12.1.6\data\inbox\log\traffic\CE10E82

As per the error, the sem5.log may be corrupted. The log needs to be recreated.

Solution: http://www.symantec.com/docs/TECH167275

But the article mentioned in the above link (TECH96159) is not available anymore. However, you may try the solution mentioned in the article at the below link to recteate the log file.

http://www.symantec.com/docs/TECH178718

Note: in this article the version of dbsrv is 11. You will need to replace this version in the command with the one that is on your server.

Eg: dbsrv16 -f "D:\SEPM 12.1.6\db\sem5.db"

See here:

SEPM 12 database does not start - Assertation Failed 100904

When I run that, I get:

dbsrv16' is not recognized as an external or internal command, operable program or batch file 

Are you able to call me or set up a remote session? I am leaving now, but would be back in office tomorrow.