Endpoint Protection

Hi There

I have a problem with SEPM running on Windows Server 2003 SP2. When I try to log in  I get 'Failed to Connect to Server' and the SemSrv service hangs. Event ID 4096 is logged in the Windows event viewer, description 'The Java Virtual Machine has exited with a code of -1, the service is being stopped.'

I've run through this article: http://service1.symantec.com/SUPPORT/ent-security.nsf/2326c6a13572aeb788257363002b62aa/86368136366e1ad78025734e004734d9?OpenDocument  as best I can (I don't know the DBA password, I think that's going to be another hurdle once this is sorted) and no joy.

I'm 90% sure I killed it while installing another web app on the same server, and absent-mindedly replaced the Application Extensions. The Reason I think that is because there are now two (as far as I can tell) unused web service extenions called 'Secars' (required files path %symantecinstalldir%\bin\secars.dll) and 'Secreg' (required files path %symantecinstalldir%\bin\secreg.dll)

I'm not sure that was the cause, but please see below contents of catalina.out and scm-server-0.log

catalina.out

08-Mar-2012 16:59:59 org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-9090
08-Mar-2012 17:00:02 org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-8443
Starting service SCM
Apache Tomcat/4.1.39
Has valid SAV license
Info>> No SNAC license file in E:\SymantecAVInstall\tomcat\etc\license
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: ================== Server Environment ===================
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: os.name = Windows 2003
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: os.version = 5.2
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: os.arch = x86
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.version = 1.6.0_14
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.vendor = Sun Microsystems Inc.
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.vm.name = Java HotSpot(TM) Server VM
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.vm.version = 14.0-b16
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.home = E:\SymantecAVInstall\jdk\jre
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: catalina.home = E:\SymantecAVInstall\tomcat
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.user = null
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: user.language = en
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: user.country = GB
08-Mar-2012 17:00:05 com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: scm.server.version = 11.0.5002.333
java.lang.ClassNotFoundException: com.sygate.scm.util.i18n.ErrorMsg_en_GB
    at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1541)
    at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1386)
    at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:320)
    at java.lang.Class.forName0(Native Method)
    at java.lang.Class.forName(Class.java:169)
    at com.sygate.scm.util.ErrorMsg.setLocale(ErrorMsg.java:224)
    at com.sygate.scm.util.ErrorMsg.<clinit>(ErrorMsg.java:217)
    at com.sygate.scm.common.communicate.CommunicationException.getMessage(CommunicationException.java:47)
    at java.lang.Throwable.getLocalizedMessage(Throwable.java:267)
    at java.lang.Throwable.toString(Throwable.java:343)
    at java.lang.String.valueOf(String.java:2826)
    at java.io.PrintWriter.println(PrintWriter.java:710)
    at java.lang.Throwable.printStackTrace(Throwable.java:509)
    at com.sygate.scm.common.communicate.CommunicationException.printStackTrace(CommunicationException.java:82)
    at com.sygate.scm.server.util.ScmFormatter.format(ScmFormatter.java:43)
    at java.util.logging.StreamHandler.publish(StreamHandler.java:179)
    at java.util.logging.FileHandler.publish(FileHandler.java:555)
    at java.util.logging.Logger.log(Logger.java:458)
    at java.util.logging.Logger.doLog(Logger.java:480)
    at java.util.logging.Logger.log(Logger.java:569)
    at com.sygate.scm.server.util.ServerLogger.log(ServerLogger.java:390)
    at com.sygate.scm.server.util.ServerLogger.log(ServerLogger.java:373)
    at com.sygate.scm.server.servlet.StartupServlet.init(StartupServlet.java:146)
    at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:880)
    at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:768)
    at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3484)
    at org.apache.catalina.core.StandardContext.start(StandardContext.java:3710)
    at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
    at org.apache.catalina.core.StandardHost.start(StandardHost.java:697)
    at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
    at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:311)
    at org.apache.catalina.core.StandardService.start(StandardService.java:450)
    at org.apache.catalina.core.StandardServer.start(StandardServer.java:2213)
    at org.apache.catalina.startup.Catalina.start(Catalina.java:484)
    at org.apache.catalina.startup.Catalina.execute(Catalina.java:371)
    at org.apache.catalina.startup.Catalina.process(Catalina.java:134)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:597)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:151)

scm-server-0.log

2012-03-08 17:00:05.633 SEVERE: ================== Server Environment ===================
2012-03-08 17:00:05.649 SEVERE: os.name = Windows 2003
2012-03-08 17:00:05.649 SEVERE: os.version = 5.2
2012-03-08 17:00:05.649 SEVERE: os.arch = x86
2012-03-08 17:00:05.649 SEVERE: java.version = 1.6.0_14
2012-03-08 17:00:05.649 SEVERE: java.vendor = Sun Microsystems Inc.
2012-03-08 17:00:05.649 SEVERE: java.vm.name = Java HotSpot(TM) Server VM
2012-03-08 17:00:05.649 SEVERE: java.vm.version = 14.0-b16
2012-03-08 17:00:05.649 SEVERE: java.home = E:\SymantecAVInstall\jdk\jre
2012-03-08 17:00:05.649 SEVERE: catalina.home = E:\SymantecAVInstall\tomcat
2012-03-08 17:00:05.649 SEVERE: java.user = null
2012-03-08 17:00:05.649 SEVERE: user.language = en
2012-03-08 17:00:05.649 SEVERE: user.country = GB
2012-03-08 17:00:05.649 SEVERE: scm.server.version = 11.0.5002.333
2012-03-08 17:00:05.805 INFO: Server startup
2012-03-08 17:00:09.758 FINE: updProcessState: checking...
2012-03-08 17:00:09.774 FINE: updProcessState: The process status has been checked.
2012-03-08 17:00:09.774 FINE: updProcessState: checking...
2012-03-08 17:00:09.789 FINE: updProcessState: The process status has been checked.
2012-03-08 17:00:13.367 INFO: use transport url:http://localhost:8014/secars/secars.dll
2012-03-08 17:00:13.367 SEVERE: ================== StartClientTransport ===================
2012-03-08 17:00:13.523 SEVERE: Unknown Exception in: com.sygate.scm.server.servlet.StartupServlet
java.lang.Exception: HTTP 404 Not Found, URL: http://localhost:8014/secars/secars.dll?action=34
    at com.sygate.scm.common.communicate.Communicator.getRequestInputStream(Communicator.java:626)
    at com.sygate.scm.server.util.ClientTransportHelper.startClientTransport(ClientTransportHelper.java:147)
    at com.sygate.scm.server.servlet.StartupServlet.init(StartupServlet.java:106)
    at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:880)
    at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:768)
    at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3484)
    at org.apache.catalina.core.StandardContext.start(StandardContext.java:3710)
    at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
    at org.apache.catalina.core.StandardHost.start(StandardHost.java:697)
    at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
    at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:311)
    at org.apache.catalina.core.StandardService.start(StandardService.java:450)
    at org.apache.catalina.core.StandardServer.start(StandardServer.java:2213)
    at org.apache.catalina.startup.Catalina.start(Catalina.java:484)
    at org.apache.catalina.startup.Catalina.execute(Catalina.java:371)
    at org.apache.catalina.startup.Catalina.process(Catalina.java:134)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:597)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:151)
com.sygate.scm.common.communicate.CommunicationException: Unexpected server error. ErrorCode: 0x10010000
    at com.sygate.scm.common.communicate.Communicator.getRequestInputStream(Communicator.java:650)
    at com.sygate.scm.server.util.ClientTransportHelper.startClientTransport(ClientTransportHelper.java:147)
    at com.sygate.scm.server.servlet.StartupServlet.init(StartupServlet.java:106)
    at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:880)
    at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:768)
    at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3484)
    at org.apache.catalina.core.StandardContext.start(StandardContext.java:3710)
    at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
    at org.apache.catalina.core.StandardHost.start(StandardHost.java:697)
    at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
    at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:311)
    at org.apache.catalina.core.StandardService.start(StandardService.java:450)
    at org.apache.catalina.core.StandardServer.start(StandardServer.java:2213)
    at org.apache.catalina.startup.Catalina.start(Catalina.java:484)
    at org.apache.catalina.startup.Catalina.execute(Catalina.java:371)
    at org.apache.catalina.startup.Catalina.process(Catalina.java:134)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:597)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:151)

I may be completely off with my Application Extension theory, but any help would be much appreciated.

Cheers

Rob

Hi,

this is the relevant piece of log:

2012-03-08 17:00:13.523 SEVERE: Unknown Exception in: com.sygate.scm.server.servlet.StartupServlet
java.lang.Exception: HTTP 404 Not Found, URL: http://localhost:8014/secars/secars.dll?action=34
    at com.sygate.scm.common.communicate.Communicator.getRequestInputStream(Communicator.java:626)

where:

404 - Not found.

Enable and check your IIS logs to get the sub error code:

• 404.0 - (None) – File or directory not found.
• 404.1 - Web site not accessible on the requested port.
• 404.2 - Web service extension lockdown policy prevents this request.
• 404.3 - MIME map policy prevents this request.

ref.: http://support.microsoft.com/kb/318380

If you already know that you damaged the Symantec web site, just repair it:

- control panel
- add/remove programs
- SEPM
- change
- repair

 

This is the main cause of it

java.lang.Exception: HTTP 404 Not Found, URL: http://localhost:8014/secars/secars.dll?action=34

Try this from the cd for sepm or download it from fileconnect and run repair from .MSI file which is in setup for sepm .

Once repair is complete it will ask for management server config close this window and run upgrade.bat from drive\programfiles\symantec\sepm\bin

it should notice that the database schema is unchanged
After that, start the service, it should stay running.
 

Hello,

There are 2 steps in which the issue can be resolved.

Solution 1:

1. Click Start> Run.
2. Type gpedit.msc.
3. Expand Computer Configuration> Windows Settings> Security Settings> Local Policies.
4. Select User Rights Assignment.
5. Double-click on Adjust memory Quotas for a Process and Replace a process-level token and verify that the "NETWORK SERVICE" is listed.
   Note: If the "Add User or Group..." option is disabled, it is possible that this policy is locked by a domain GPO (group policy object) which will require an assessment of domain GPOs. 
6. Restart the "IIS Admin" service to update any changes.

Solution 2:

1. Stop the service for Symantec Endpoint Protection Manager.
2. Perform repair on SEPM using the installation CD.
3. Then try to login to SEPM.

I would also request you to make sure you migrate to the Latest version of SEP 11.0.7101

http://www.symantec.com/docs/TECH171552

Hope that helps!!