Video Screencast Help

Single Risk Event E-mails in SEP 12RU1MP1

Created: 15 Jun 2012 | 13 comments

Good morning,

  Since updating SEPM to 12RU1MP1, whenever we get a Single Risk Event we're getting an e-mail every 3 minutes for roughly an hour on the same event.  I've tried deleting the notification condition and recreating it but the results are the same.  I tried changing the damper from auto to an hour as well but again, the results were the same.  This was not an issue for us in 11RU7. 

  Anyone else experiencing similar issues or know what can be done to correct this?

  Thank you.

Comments 13 CommentsJump to latest comment

Simpson Homer's picture

How many logins do you have for SEPM? Are there more than one person trying to access SEPM?

Login as an Admin which has all privileges and also make sure that its password is set to never expire. And then delete the existing notification and then re-create the same and see if it helps.

Mithun Sanghavi's picture


Symantec is aware about this issue. The Issue seems to have been resolved in the Upcoming Version of SEP 12.1 RU2

I would request you to create a case with the Symantec Technical Support on the same.

QuickStart Guide - Create and Manage Support Cases in SymWISE

How to update a support case and upload diagnostic files with MySupport


To Call Symantec Technical Support :

Hope that helps!!

Mithun Sanghavi
Associate Security Architect


Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

c_olson's picture

I created a case on it and have tried creating the notification with the admin role instead of a domain admin. I'll monitor until we receive a new notification and follow up.

c_olson's picture

We received our first alert after recreating the notification with the admin (not domain admin, which we had already tried).  Still receiving notifications every 3 mins for the same alert. 

ᗺrian's picture

Was the original admin that created the alert deleted from the system without first deleting the alert?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

c_olson's picture

Nope.  Admin created the original alert.  I deleted it and created it again (domain admin).  Then I deleted the one created by the domain admin and created it as an admin.

Mohan Babu's picture

Additional improvements are expected in the next release of SEP 12.1. 

Multiple Symantec Endpoint Protection Manager email notifications are sent for old events

Supplemental Materials

Source ETrack
Value 2212158

SEP 12 SMB -- Multiple Risk Outbreak email notifications are sent within the Damper period

Source ETrack
Value 2233045

SEP 11 RU6 MP2 --- SEPM email notifications sent repeatedly for old events


Mohan Babu

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

c_olson's picture

That article states a fix for 12.1 was employed in SEP 12.1 RU1.  We're on 12RU1MP1 and this is an active issue for us.  What was the fix mentioned? 

Eamonn Higgins's picture

We are on Version 12.1.1101.401 RU1 MP1 and have the same issue. I am tried of getting all of these emails! Please help.

Mohan Babu's picture

This issue is not fixed yet. The fix might be available in SEP 12.1 RU1 MP2. Symantec will release this 12.1 RU1 MP2 soon because its a global issue 

Mohan Babu

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

Ashish-Sharma's picture


There is no official date for the release. You may see the Release of SEP 12.1 RU2 will be released anytime this year.

As of now, the SEP 12.1 RU2 is under BETA testing.

Incase, if you are interested in Beta Testing for SEP 12.1 RU2, check this :

Thanks In Advance

Ashish Sharma

pete_4u2002's picture

there is nothing like ru1 mp2, it will be SEP 12.1 RU2.