SEPM Upgrade from RU6MP1 to RU6MP2 Finished. Initial impression
I finished upgrading three of our SEPM servers this morning to RU6 MP2. The upgrade was painless except for the fact that it wants you to shut down the SEPM application on the servers. This caused our clients to drop from a corp net policy to a home policy which is very restrictive. Our location awareness policies have a combination of and's & or's but they all include cant reach management console or can reach management console. The thought was since we had these load balanced across multiple SEPM servers we could stop the SEPM service on one and all clients would fail to the active ones. Then we could upgrade the first server. Take down the next server and bring up the first server and the clients would fail over while we upgraded the second server, etc....
Outside of that everything seems normal except the Status Summary on the Home page.
It's reporting we have 30 something systems with auto protection off but when you click to view the report only 3 clients are shown.
The restart required number jumped like 2 - 3x what it was before the upgrade and we havent even started deploying the new MP2 to clients.
Not reporting status shows a value which equals a 1/3 of our total clients and the value was zero before the upgrade. Clicking on the report brings up a message of "nothing to report" as no clients are listed.
Is there a way to purge this information and let the client populate it again?
Comments
As an update I ran a computer
As an update I ran a computer status log export to excel and filtered for the same information that is reported on the status summary tab.
Using this method reflects the numbers we saw before the upgrade which are much lower than the status summary report
If I remember correctly, all
If I remember correctly, all migration documentation mentions stopping the SEPM service and removing replication partnerships prior to doing an upgrade, doing the migration up on all SEPMs involved, then re-establishing replication.
I am in process of migrating right now, and I did notice that a new pane comes up during install that directs you to close the SEPM if you have it open and are logged in, locally and/or remotely.
I believe the status summary report is over the previous 24 hours...
sandra
Symantec Endpoint & Mobility Group / Information Development
Don't forget to mark your thread as 'solved' with the answer that best helped you!
Thanks Sandra. We do not use
Thanks Sandra. We do not use any replication, only load balancing. Maybe it would have worked using my desired method but when i was prompted not to continue until all SEPM's were shutdown I played it safe and did just that.
Then again is the message saying to stop the SEPM service or make sure the consoles are not running or logged in?
For clarity, the migration
For clarity, the migration documentation specifically says to stop the SEPM service. From the RU6 MP1 document, bullet point 4 under "Overview of the migration process" (I can't seem to locate an RU6 MP2 document, but the heart of it is nearly always the same):
Before you upgrade, you must manually stop the Symantec Endpoint Protection Manager service on every management server in your site. After you upgrade, the service is started automatically.
WARNING: You must stop the Symantec Endpoint Protection Manager service before you upgrade, or you will corrupt your existing installation of Symantec Endpoint Protection Manager.
The service being off will mean the SEPM is unable to be reached via heartbeat. It may be prudent, in cases where Location Awareness is in use and is defined based on whether or not the SEPM can be reached, to temporarily increase the heartbeat and allow clients to check in and get that policy before beginning the migration. The upgrade itself should not take very long and once it's over, the service restarts and clients should be able to reach the SEPM again.
I can't see the exact wording of the pane anymore, but if I remember correctly the SEPM, the Migration and Deployment Wizard and the Database backup program were all listed, so I took that to mean the applications needed to be closed too--in all sessions, local or remote.
sandra
Symantec Endpoint & Mobility Group / Information Development
Don't forget to mark your thread as 'solved' with the answer that best helped you!
The difference in numers on
The difference in numers on Home page and in Reports may be due to different time frames - for Home by default is is 24h while for reports you can choose customized ones.
--
Cheers,
Symantec Technical Specialist
Symantec Certified Specialist
MCP & MCITP
Cisco Certified Network Associate
Citrix Certified Administrator
As far as the status summary
As far as the status summary is concerned your correct it's supposed to be 12/24 hours depending on your preferences.
I have it set for 24 hours and when I ran the computer status log export it was also set for 24 hours so technically this should reflect the exact same information.
anybody knows if i can
anybody knows if i can upgrade from RU6a to RU6 MP2?
Yes, you can - as the
Yes, you can - as the documentation says, it must be installed on RU6, RU6a or RU6 MP1 :-)
--
Cheers,
Symantec Technical Specialist
Symantec Certified Specialist
MCP & MCITP
Cisco Certified Network Associate
Citrix Certified Administrator
Step upgrade
I'd recommend upgrading to RU6 MP1 first as that will have intial patches for RU6a that aren't included in RU6 MP2.
Review my idea for GUP reporting please vote with a yes if you think it's a good idea.
https://www-secure.symantec.com/connect/ideas/gup-report-program
what kind of initial patches
what kind of initial patches
Which patches do you mean?
Which patches do you mean? The release notes says it may be upgraded directly from RU6 and Ru6a.
--
Cheers,
Symantec Technical Specialist
Symantec Certified Specialist
MCP & MCITP
Cisco Certified Network Associate
Citrix Certified Administrator
See below link
Have a look at the below link it will advise of each fix that is applied by each patch.
http://www.symantec.com/business/support/index?page=content&id=TECH103087
Top will start with RU6 MP2 as you go further down you will see the fixes applied by RU6 MP1
Review my idea for GUP reporting please vote with a yes if you think it's a good idea.
https://www-secure.symantec.com/connect/ideas/gup-report-program
C'mon it does not mean that
C'mon it does not mean that RU6 MP2 does not contain fixes provided by MP1. This would be as if RU6 had no fixes provided by RU5.
--
Cheers,
Symantec Technical Specialist
Symantec Certified Specialist
MCP & MCITP
Cisco Certified Network Associate
Citrix Certified Administrator
Better safe than sorry
Then you'd also expect RU6 MP2 to include things supplied by RU6a yet multiple forums in here say to install MP1 after RU6a. Yet when you speak to symantec support directly they say that there is no issue from going from RU5 to RU6 MP1. So I'm just advising the step by step upgrade to be safe as there seems to be information suggesting both ways are fine.
Review my idea for GUP reporting please vote with a yes if you think it's a good idea.
https://www-secure.symantec.com/connect/ideas/gup-report-program
Well, I am from Symantec tech
Well, I am from Symantec tech support and yes, we always advice upgrade to RU6 MP1 from RU6 only. This is due to the information in release notes - the developers know what they do and we should follow their indications. In RU6 MP2 release notes there's a clear information which version SEPM can be upgraded from to RU6 MP2.
moreover, I suspect that restricions to RU6 MP1 which cannot be installed on RU5 is due to differences in DB schema rather than fixes. But I might be wrong. Anyways, I updated SEPM RU5 directly to RU6 MP1 as well but I have never and never will advise it as a correct way. Just follow the instructions from developers and you should be fine :-)
--
Cheers,
Symantec Technical Specialist
Symantec Certified Specialist
MCP & MCITP
Cisco Certified Network Associate
Citrix Certified Administrator
Does what it says on the tin
Yup I agree follow what it says on the packet ;)
Review my idea for GUP reporting please vote with a yes if you think it's a good idea.
https://www-secure.symantec.com/connect/ideas/gup-report-program
I think I've figured out the
I think I've figured out the issues with the status summary. It appears the SAV10 logs we are forwarding to the SEPM are causing this report numbers to be inflated. Basically the number of systems not reporting status directly correlates to the SAV10 clients when I look at the computer status logs. The home page status summary will only display SEPv11 client information it appears, hence the reason why no clients show when I click the number under the computers column.
SAV clients will NOT report
SAV clients will NOT report to SEPM server. These are very different products.
EDIT: I mean, cannot be managed as SEP clients. The can forward logs however:
http://www.symantec.com/business/support/index?pag...
--
Cheers,
Symantec Technical Specialist
Symantec Certified Specialist
MCP & MCITP
Cisco Certified Network Associate
Citrix Certified Administrator
hi
click on preference on the home tab;
and uncheck update logs from SAV 10 clients, this is the one which is causing the issue.
Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq
Yes we are using SEPM for
Yes we are using SEPM for SAV10 logs not management of SAV10. This is a desired configuration until SAV10 is removed from our environment. Prior to MP2 the status summary didnt reflect SAV10 logs but it appears it does now except it will not show the actual systems in the report.
Try a different location requirement
I never use the location awareness feature that has the requirement that the SEPM's are available for exactly the reason you have described.
I usually use a dns lookup that only resolves when on the internal network as it is much more reliable. It is basically never going to get matched on the internet!
You just have to be a little careful with clients coming back over VPN's and suddenly able to resolve internal hosts.
If your DNS servers are down you have much bigger issues than SEP location awareness :)
Would you like to reply?
Login or Register to post your comment.