Video Screencast Help
Search Video Help Close Back
to help
Not able to make it to Vision this year? Get a sampling in the Best of Vision on Demand group.

Symantec Endpoint database issue

Updated: 05 Dec 2011 | 13 comments
mvarandani's picture
0 0 Votes
Login to vote

Hi All,

I am working on Symantec Endpoint Protection version 11.x having embedded database via sem5.db.Is there any possiblity to open the file or map this file with any database management studio like sql server/sql lite??

My end goal is to create the custom sql queries to fetch the data.

Thanks in advance.

-mahendra

Discussion Filed Under:

Comments

Thomas K's picture
05
Dec
2011
2 Votes +2
Login to vote

Check out the database Schema

Check out the database Schema Reference.You can create and run queries on the database by using the information in this document.

http://www.symantec.com/business/support/index?pag...

I hope this is helpful.

Best, Thomas

 

Moving this thread to the Endpoint Protection forum.

mvarandani's picture
06
Dec
2011
0 Votes 0
Login to vote

need to read the sem5.db

Hi Thomas,

Thanks for the information.But please tell me how to execute queries on that,As i have sem5.db file.So how to read the file and execute the fetch the data.

Thanks again!!

Regards,

Mahendra

pete_4u2002's picture
06
Dec
2011
1 Vote +1
Login to vote

open the dbisqlc.exe which is

open the dbisqlc.exe which is located under C:\Program Files\Symantec\Symantec Endpoint Protection Manager\ASA\win32\. you can use the sql queries using the DB schema.

James-x's picture
06
Dec
2011
1 Vote +1
Login to vote

pete_4u2002 hit the nail on

pete_4u2002 hit the nail on the head, but I thought I'd expand his instructions to make them a little simpler.

  1. Connect to the SEPM server
  2. Open this path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\ASA\win32
  3. Double-click dbisqlc.exe
  4. Click Data source name
  5. Select SymantecEndpointSecurityDSN
  6. Type in your User ID (default: dba)
  7. Type in the password you specified when you configured the SEPM for the first time. If you do not remember picking a password, try the original password for the SEPM's "admin" account.
  8. Click OK.

The Interactive SQL window will open up. You can run SQL queries from here. Obviously, be VERY careful when running queries on the database since you run the risk of damaging the database. (You'd be best off only running SELECT queries and never attempting to update the database by hand.)

Regards,

James

The Symantec Endpoint Protection Knowledgebase

Please remember to mark the post which resolved your issue as the solution!

Jeremy.L's picture
06
Dec
2011
1 Vote +1
Login to vote

Hi Thomas,   Alternatively

Hi Thomas,

  Alternatively you can configure the SEPM to use a Microsoft SQL server DB, this makes it easier to manage and very simple to run queries against.

Before thinking of using customer queries to fetch data, you may want to check all the logs and reports that can be seen and exported in the SEPM, these should cover most organizations needs.

Specific customer queries can be somewhat difficult to write and generate complex queries that may impact performance on larger databases.

--
Symantec Support
MCSE / CCNA

mvarandani's picture
07
Dec
2011
0 Votes 0
Login to vote

Hi Jeremy, Is this possible

Hi Jeremy,

Is this possible to them also who had initially installed there SEPM with embedded database and now if they want to migrate thier SEPM data  to SQL server without loosing the previous data.?

Will you please assist me in the procedure of mapping the data to sql server?

Thanks
Mahendra

pete_4u2002's picture
07
Dec
2011
2 Votes +2
Login to vote

yes this is possible, check

yes this is possible, check the link

Symantec Endpoint Protection Manager: Moving from the Sybase Embedded Database to Microsoft SQL Server

http://www.symantec.com/business/support/index?page=content&id=TECH102547

mvarandani's picture
07
Dec
2011
0 Votes 0
Login to vote

Auto feed

Thanks to all..

I am able to log-in to Interactive SQL window and executed manually all the sql queries.

But still i am facing a issue:

In the current scenario :
I am able to wirte the queries in the given Command box and it is showing me the fetched rows in data window.

But as per the requirement:I have to write a external schedule job which fetch the data from SEPM server automatically and import the data in my external source;to achieve this I am following the model like creating same database structure in my external repository where I give the connection string with login credentials wich import the data from SEPM and feed in my external source.

Or
If possible we can fetch the data in some flat file(SQL,csv,xls)??

Just for information I am working on integration of SEPM with RSA archer where I want to feed the Archer from SEPM.

Thanks again to all for quick response.

Regards,
mahendra

James-x's picture
07
Dec
2011
0 Votes 0
Login to vote

Hello, What sort of data did

Hello,

What sort of data did you want to pull out of the database?

We make a free product called IT Analytics which can pull data from our database and then create many reports which are not possible with the SEPM alone. As opposed to using a 3rd party product to do this, IT Analytics is supported and created by Symantec.

IT Analytics is included in the installation files of newer versions of Symantec Endpoint Protection. (I think 11.0.6 and higher, but don't quote me.) Check the Tools subfolder.

Regards,

James

The Symantec Endpoint Protection Knowledgebase

Please remember to mark the post which resolved your issue as the solution!

mvarandani's picture
14
Dec
2011
0 Votes 0
Login to vote

Ok James,Now I had

Ok James.Thanks for suggestion.

Now I had re-installed my SEPM instance and SQL server 2005.

While doing the Management server configuration I had selected sql server and provided all the mandatory details as :server name,username,password,port etc.

But after pressing "Next" SEPM invokes a message saying:

"Failed to connect to the database"

Please make sure the database server port is not used by another application and that your password is correct.

I don't know whats going wrong as I checked the 1433 default port is properly listening by SQl server itself,then why it is saying the database server port is used by other application"

Thanks in advance.

 

Regards,
Mahendra varandani

James-x's picture
14
Dec
2011
1 Vote +1
Login to vote

Hello, Do the SQL logs give

Hello,

Do the SQL logs give any clue why the SEPM can't connect?

http://msdn.microsoft.com/en-us/library/ms187885.aspx

If you are unsure how to read them, attach them here.

Regards,

James

The Symantec Endpoint Protection Knowledgebase

Please remember to mark the post which resolved your issue as the solution!

mvarandani's picture
15
Dec
2011
1 Vote +1
Login to vote

Yes..Gotcha got a clue from

Yes..Gotcha got a clue from logs.

Didn't created the Logical names in Fields.

Reference:
https://www-secure.symantec.com/connect/forums/cre...

Thanks James.

Regards,
Mahendra Varandani

mvarandani's picture
20
Dec
2011
0 Votes 0
Login to vote

Polcies

Hi All

I had successfully installed SEPM.

Now I was trying to integrate the clients to see the usage of SEPM in live.

Till I follwed below steps :

Searched the unknown and unmanaged computers in manager console of SEPM there I selected one network workstation and push the client installations in it which was successfull.

For now my SEPM default dashboard is showing only blank graphs and one active clinet with localhost under Group-->Clients tab.

I am unable to understand that what is the next step:Do i have to create the policies in it or anyother settings which i missed thats'y graphs are blank?

Please assit me..What is the basic work around of SEPM after installation and how do i see/monitor my network workstation?

Thanks in advance.

Regards

Mahendra Varadani