Endpoint Protection Small Business Edition

I deployed SEPM 11.0.6 in a middle sized company ,every thing worked well,but recently i noticed when opening the console  that some rubrics at the startup page(real time statistics) are empty or show wrong statistic numbers.

i've tried to repair the installation , i also restored database content to previous copy,but didn't work .

i need your help .

Thank you

Which of them are wrong and how do you know if they are wrong? Please note that by default Home page will show information from last 12 hours.

here is an example of wrong statistics shown by startup page

Could you please put a bit bigger screenshot.

Also, wait for a few hours so that DB data is parsed by the console.

ok,i've just received the captures ,here is the different elements we have trouble with.

Attachment(s)

rapport 2.zip   248 KB 1 version

See this KB, it may clear things up for you.

Still Infected status not clearing on Symantec Endpoint Protection Manager home page -

http://www.symantec.com/business/support/index?page=content&id=TECH95463&actp=search&viewlocale=en_US&searchid=1292606986700

About the Symantec Endpoint Protection Home page -

http://www.symantec.com/business/support/index?page=content&id=HOWTO27289&actp=search&viewlocale=en_US&searchid=1292606819209

Ok, so it is Still infected (Encore infecte') What it really is that there was some kind of event on the client - like a threat was detected and cleared, etc. So it does not necessarily mean that the clients are infected - but due to corrupted or incorrectly processed logs from clients, the console does not "know" that the machine is clean and it shows the it is "still infected".

Follow the document

Still Infected status not clearing on Symantec Endpoint Protection Manager home page
http://www.symantec.com/docs/TECH95463

and clean the logs manually. Then, if some machines reappear there - control them.

Let us know if you have more questions.

hey pawl,

I've tried the guidelines but unfortunately nothing changed on the reports,i just want to know if refreshing or redeploying the sylink.xml file to the clients will enable refreshing data reporting on the server

Cordially 

You should be able to remove Still infected status from your console. Did you selected "still infected" machines and clicked Clear status?

could you please show how to remove still infected status from the console ,can't find out how

still infected value has disappeared ,but it doesn't make sens because more than 600 symantec Clients and only 3 blocked viruses ,there must be something wrong .

please see  the attachement below for confirmation

If you removed still infected, the counter was zeroed. The best course of action would be to watch Still infected counter and if something appears check the machine (if the action was Lesft alone for example) to make sure it is clear.

how about the fact i'am using a Update provider computer in distant sites ???

Cordially

This should not be a problem - the data on Home is the data queried from local embedded DB (or SQL on another machine).

they don't understand how 600 pc"s generate only 3 blocked viruses since last friday

Are there expected more viruses in the environment? ;-) Maybe there were only 3. And mind that it is not since Friday but for last 24h. When did you clean Still infected?

they did it friday and the bloked value was "3",and when i repeated the guidelines you posted ,the blocked value keeped in "3".

Cordially

Mike,

The values on Help show data from last 24h. Did you try to refresh the console? Maybe restart the service?