Video Screencast Help
Search Video Help Close Back
to help

The SEPM shows client virus definition as "Not available"

Created: 06 Mar 2013 | 26 comments
Kian_SG's picture
0 0 Votes
Login to vote

When I view the client status in SEPM, the virus definition shows the clients are "Not available" even though the clients have already received the latest virus definition and even the policy number.

I cannot even generate the report from SEPM because it is empty records found in SEPM.

Please help...

 

  

Operating Systems:

Comments 26 CommentsJump to latest comment

Brian81's picture

It should show up on next heartbeat in. Check again after the client checks back in.

0
Login to vote
Kian_SG's picture

The information didn't show up for more than 4 days. 

0
Login to vote
SebastianZ's picture

Are the definitions up to date if you check directly on the client machines?

0
Login to vote
Kian_SG's picture

Hi SebastianZ,

Yes, the client machines is getting the virus definition update and updated policy from SEPM.

The SEPM version is 12.1.2015.2015 running on Windows 2003 R2 with MS SQL 2005.

0
Login to vote
Rafeeq's picture

on any single client

go to start run 

smc -stop

wait for a min

smc -start

check if that comes up with new def info.

Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq

0
Login to vote
admin_sepm's picture

One reason is that your defintion of the client systems getting corrupt.

try it

How to clear out definitions for a Symantec Endpoint Protection 12.1 client manually

 

Article:HOWTO59193  |  Created: 2011-09-08  |  Updated: 2012-09-25  |  Article URL http://www.symantec.com/docs/HOWTO59193

 

Thanks.

0
Login to vote
Mohan Babu's picture

Delete the clients from the SEPM console

Clients will register again in SEPM  on the next heart beat interval

It will show the correct information

Mohan Babu

moglie20@gmail.com

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

0
Login to vote
Kian_SG's picture

Hi Mohan, Done, but after 2 hours of waiting, still no luck !

0
Login to vote
Ambesh_444's picture

Hi,

Please reboot the sepm and check.

 

Thank& Regards,

Ambesh

Please mark your thread as 'SOLVED' with the answer that helps you.

0
Login to vote
Kian_SG's picture

Reboot multiple times.

0
Login to vote
Rafeeq's picture

on any single machine run the intelligent updater and check the status

20130306-017-v5i32.exe

http://www.symantec.com/security_response/definiti...

Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq

0
Login to vote
Mohan Babu's picture

In your case client can able to communicatewith SEPM. But SEPM is not processing the client data.

 

Problem

 

 

When checking the computer status in Symantec Endpoint Protection Manager (SEPM), clients say that they are not reporting status.

Symptoms
Can't confirm if commands were sent successfully.

  • Status page shows various failures.

  • No entries in the Virus Definitions Distribution box.

  • No data about the clients at all in SEPM.

  • Clients and SEPM don't show the same data for definition dates

  • "The data folder disk space is full" errors in the exsecars.log file

Reference:

Clients cannot send data back to Symantec Endpoint Protection Manager

http://www.symantec.com/docs/TECH105348

 
 
Kindly try this troubleshooting step: 

1. Browse to \Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\agentinfo

2. Look for any .err files or tmp files & Dat files

3. If you find anything which is not processed by sepm then it might be the reason for the client data loss

4. Stop SEPM services from services.msc 

5. Delete all the files inside the location \Program Files\Symantec\Symantec Endpoint Protection Manager\data\inbox\agentinfo

6. Restart the SEPM services.

Check the SEPM now if still issue persist go for step 7

 

7. Run the Management server configuration wizard.

Note: While running Management server configuration wizard it requires Database password. if you running SEP 12.1.2 it wont prompt you for DB password.

 

Kindly update us the status .... thanks 

 

 

Mohan Babu

moglie20@gmail.com

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

+2
Login to vote
Rafeeq's picture

Correction: the folder is Browse to \Program Files\Symantec\Symantec Endpoint Protection Manager\data\INBOX\agentinfo 

not outbox\agent info.

You may refere this document

http://www.symantec.com/business/support/index?pag...

 

Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq

+2
Login to vote
Mohan Babu's picture

Thanks for correcting Rafeeq

 

Mohan Babu

moglie20@gmail.com

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

0
Login to vote
SameerU's picture

Hi

Can you please delete the client from SEPM console and do a smc stop and start on client system.

Regards

 

0
Login to vote
DVlad's picture

Hi Kian_SG

I have the same symptoms.
You decide your problem? If so, how?

0
Login to vote
SameerU's picture

Hi

Can you repair the same

Regards

 

0
Login to vote
ManishS's picture

hope this bug fix in SEP 12.1 RU2 MP1

Clients report to the Symantec Endpoint Protection Manager as offline, even though they are online
 
Fix ID: 3002170
 
Symptom: Clients will randomly report into the Symantec Endpoint Protection Manager as offline, even though they are actively online and available.
 
Solution: Updated the client USN management to properly update the client status in the Symantec Endpoint Protection Manager reports.
 

 

Thanks In Advance.

Manish

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

0
Login to vote
Berino's picture

Hi Kian  :)

I see your problem and I had the same too in the past. The SEPM is not completely in Sync with the Database specially when it is a SQL DB (Certain details alone are not updating on a real time basis or are not updating at all)

Solution:

Step 1: Run the management server configuration wizard

Step 2: Reboot the SEPM and the SQL Server once (if you can get a down time on the servers)

Then you'll see the correct data. This helped me resolve my issue. Keep us posted on the developments.

Cheers  :)

 

0
Login to vote
SameerU's picture

Hi

Can you delete the client from SEPM console and update the policy and check

Regards

 

0
Login to vote
SEP_FMI's picture

I too am having this problem and have not found a reoslution yet for this.  Basically it seems like the SEP client is reporting back to the SEPM but only certain fields.  Ones that appear up to date include Health State, Logon User or Computer, IP Address, Client Version, Last Time Status Changed, Policy Serial Number.  Virus Definition seems to be the one causing problems.  If I check from the SEP Client its up to date.

Anyone figure this out?  I'm using SEP 12.1 RU2

0
Login to vote
davek8814's picture

i found that i had some low disk space-i cleaned that up and have started an update content from the manager-so far nothing but when I do a update policy from the client machine it updates, so I am going to wait and see if the request sent from the manager works. 

0
Login to vote
theexplorer's picture

This is common issue, Please follow Rafeeq's advice, run intelligent updater. Later the update will go fine.

Good Luck!

0
Login to vote
davek8814's picture

should we look in other folders for .tmp, .err and .dat files as well?

0
Login to vote
theexplorer's picture

Also post the lue.log from any affected machine.

On Windows XP and Windows server 2003:
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs

On Windows Vista, Windows 7, and Windows Server 2008:
C:\Program Data\Symantec\Symantec Endpoint Protection\<silo_id>\Data\Lue\Logs

 

 

 

Good Luck!

0
Login to vote