Endpoint Protection

Good afternoon all,

I've been searching for solutions to this issue for awhile now and am hoping an expert may be able to point me to the best direction per my situation. I've posted both of the logs everyone appears to want to see.

There haven't been any major (or minor) additions to this server in 3+ months. I change the password today, attempt to build out a .exe to deploy on some seats, the deploy starts running and fails so I terminate the process and reboot. Once it comes back online the SEPM service keeps stopping and I'm getting this Java 1 error. It is not a fresh install and has been working for some time, quite well even.

If anyone can help wit ha sure fire way to resolve this issue it would be greatly appreciated.

scm-server-0.log
2009-09-02 15:12:25.774 SEVERE: ================== Server Environment ===================
2009-09-02 15:12:25.790 SEVERE: os.name = Windows 2003
2009-09-02 15:12:25.790 SEVERE: os.version = 5.2
2009-09-02 15:12:25.790 SEVERE: os.arch = x86
2009-09-02 15:12:25.790 SEVERE: java.version = 1.5.0_15
2009-09-02 15:12:25.790 SEVERE: java.vendor = Sun Microsystems Inc.
2009-09-02 15:12:25.790 SEVERE: java.vm.name = Java HotSpot(TM) Server VM
2009-09-02 15:12:25.790 SEVERE: java.vm.version = 1.5.0_15-b04
2009-09-02 15:12:25.790 SEVERE: java.home = C:\Program Files\Symantec\Symantec Endpoint Protection Manager\jdk\jre
2009-09-02 15:12:25.790 SEVERE: catalina.home = C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat
2009-09-02 15:12:25.790 SEVERE: java.user = null
2009-09-02 15:12:25.790 SEVERE: user.language = en
2009-09-02 15:12:25.790 SEVERE: user.country = US
2009-09-02 15:12:25.790 SEVERE: scm.server.version = 11.0.4000.2295
2009-09-02 15:12:28.040 SEVERE: ================== StartClientTransport ===================
2009-09-02 15:12:28.134 SEVERE: Unknown Exception in: com.sygate.scm.server.servlet.StartupServlet
java.lang.Exception: HTTP 401 Unauthorized, URL: http://localhost:8014/secars/secars.dll?action=34
 at com.sygate.scm.common.communicate.Communicator.getRequestInputStream(Communicator.java:556)
 at com.sygate.scm.server.util.ClientTransportHelper.startClientTransport(ClientTransportHelper.java:72)
 at com.sygate.scm.server.servlet.StartupServlet.init(StartupServlet.java:104)
 at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:880)
 at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:768)
 at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3484)
 at org.apache.catalina.core.StandardContext.start(StandardContext.java:3710)
 at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
 at org.apache.catalina.core.StandardHost.start(StandardHost.java:697)
 at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
 at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:311)
 at org.apache.catalina.core.StandardService.start(StandardService.java:450)
 at org.apache.catalina.core.StandardServer.start(StandardServer.java:2213)
 at org.apache.catalina.startup.Catalina.start(Catalina.java:484)
 at org.apache.catalina.startup.Catalina.execute(Catalina.java:371)
 at org.apache.catalina.startup.Catalina.process(Catalina.java:134)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
 at java.lang.reflect.Method.invoke(Method.java:585)
 at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:151)
com.sygate.scm.common.communicate.CommunicationException: Unexpected server error. ErrorCode: 0x10010000
 at com.sygate.scm.common.communicate.Communicator.getRequestInputStream(Communicator.java:580)
 at com.sygate.scm.server.util.ClientTransportHelper.startClientTransport(ClientTransportHelper.java:72)
 at com.sygate.scm.server.servlet.StartupServlet.init(StartupServlet.java:104)
 at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:880)
 at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:768)
 at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3484)
 at org.apache.catalina.core.StandardContext.start(StandardContext.java:3710)
 at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
 at org.apache.catalina.core.StandardHost.start(StandardHost.java:697)
 at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
 at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:311)
 at org.apache.catalina.core.StandardService.start(StandardService.java:450)
 at org.apache.catalina.core.StandardServer.start(StandardServer.java:2213)
 at org.apache.catalina.startup.Catalina.start(Catalina.java:484)
 at org.apache.catalina.startup.Catalina.execute(Catalina.java:371)
 at org.apache.catalina.startup.Catalina.process(Catalina.java:134)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
 at java.lang.reflect.Method.invoke(Method.java:585)
 at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:151)

catalina.out

Sep 2, 2009 3:12:24 PM org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-9090
Sep 2, 2009 3:12:24 PM org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-8443
Starting service SCM
Apache Tomcat/4.1.37-LE-jdk1.4
Has valid SAV license
Info>> No SNAC license file in C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\license
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: ================== Server Environment ===================
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: os.name = Windows 2003
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: os.version = 5.2
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: os.arch = x86
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.version = 1.5.0_15
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.vendor = Sun Microsystems Inc.
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.vm.name = Java HotSpot(TM) Server VM
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.vm.version = 1.5.0_15-b04
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.home = C:\Program Files\Symantec\Symantec Endpoint Protection Manager\jdk\jre
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: catalina.home = C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.user = null
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: user.language = en
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: user.country = US
Sep 2, 2009 3:12:25 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: scm.server.version = 11.0.4000.2295
Utility>> emptyDir: Error, Can NOT delete -> C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\temp\jar_cache6479.tmp

Thanks again

Follow these Steps

Open IIS and Expand Default Website and Right Click on Symantec Website and go to Properties

Click on Directory Security Tab and click on Edit Button for Authenticated and Access Control option

Make a check mark for Integrated Windows Authenticated Option and Apply and click OK.

Restart the IISAdmin Service and Symantec Endpoint Protection Manager Service

Should able to Log in into the SEPM.



If this Does not work then follow this

Go to Symantec Endpoint Protection Manager install location.

By defaut it is on "C:\Program Files\Symantec\Symantec Endpoint Protection Manager(SEPM)"

Right click on SEPM folder go to Security Tab and Add Authenticated User and Everyone and give Full Permission

Please mark this as a solution if this works :)

Read this Symantec KB for starters.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007120311342100

Thomas

I do not receive a Windows logon or 401 error... This is also not a fresh installation of SEPM, SEPM has been functioning for months until this required password change and reboot.

Did you tried to follow the steps that I have told you???

The 401 error is showing in the log.

2009-09-02 15:12:28.134 SEVERE: Unknown Exception in: com.sygate.scm.server.servlet.StartupServlet
java.lang.Exception: HTTP 401 Unauthorized, URL: http://localhost:8014/secars/secars.dll?action=34

Are you getting Java 1 or Java -1 error?
The heading for your post says Java -1  and the post says Java 1.

According to the logs,

2009-09-02 15:12:28.134 SEVERE: Unknown Exception in: com.sygate.scm.server.servlet.StartupServlet
java.lang.Exception: HTTP 401 Unauthorized, URL: http://localhost:8014/secars/secars.dll?action=34

Title: '"Failed to connect to server" message during login, scm-server-0.log file shows '401 Unauthorized' errors and SemSrv will not stay in started state'
Document ID: 2009073117184848
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2009073117184848?Open&seg=ent


Title: '"Java -1" error in event log and the error "Failed to connect to server" at login, with HTTP 401 in scm-server-0.log, HTTP 401 1 0 in IIS Logs'
Document ID: 2008101518485148
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2008101518485148?Open&seg=ent


If you are getting JAVA 1

Go to C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Tomcat\conf\server.xml

Change the default value for the port from 8005 to 8006.

Save this file and start the Symantec Endpoint Protection Manager service.

-Make a check mark for Integrated Windows Authenticated Option and Apply and click OK.
Restart the IISAdmin Service and Symantec Endpoint Protection Manager Service
Should able to Log in into the SEPM.
-This solution worked.

However, does this have to do with the password that I changed? I noticed IUSR_NAME with a password in the box, I changed it to what I changed the password to and this did not work. How can I get back to using the anonymous logon as the system was originally set up?

I apologize, the title was correct, the error was Java -1. I will be trying the remaining solutions tomorrow if it gets me back to the anonymous logon with credentials option.

I will come back and post my results. Once again thank you for your assitance.

What password have you Chnaged????

If you are not sure about the Iusr password. Just leave the password field blank & run click Ok in the IIS for Iusr account it will automatically pick the password for Iusr account.

Checking that Integrated auth box os what is recommended by Symantec as well

Check this document

http://service1.symantec.com/support/ent-security.nsf/docid/2009073117184848

Kavin, I appreciate your help, I'm not sure why the system was originally set up to: allow anonymous logon. I changed the password to log into the SEPM Console as it said that it had expired. After that point, i was unable to login again, although it did accept the original new password input.

The ISS should be configured for anonymous logon. Dont worry after checking the integrated windows atuth check box if you are able to log in to the SEPM then thats the solution for your issue.

Right, I unchecked ISS the first time around. I rechecked it and with the other option (Integrated Windows Authenticated Option) checked I am still able to log on.

Now I have a question, or maybe need to do more research on IIS accounts, but the IUSR_account. I imagine that password should match the actual users password. What all does this account affect if I change the password?