Endpoint Protection

We have been experiencing thousands of these error messages:

%PROGRAMFILES%\Symantec Endpoint Protection Manager\tomcat\temp\indexW.html (The system cannot find the file specified)

I have opened up a support case and closed it because the answer to connect the policy manager to the internet is not a solution.  Has anybody seen these and been able to stop them from flooding the logs?  We have notifications setup for critical errors and it fires off so many times because of these that important things get missed.

Thanks.

Try this

http://www.symantec.com/business/support/index?page=content&id=TECH103096&locale=en_US

I will give that a try.  Now, by doing this, what is this all turning off and what affect will it have on our Policy Managers?

I don't think that document has anything to do with your issue. It's talking about Tamper Protection.

You've indicated that your SEPM does not have internet access; you probably cannot also see any info on the SEPM home page pertaining to Security Response information. The message is occurring because there is no internet connection. Unfortunately, it is expected behaviour.

Endpoint Manager Console homepage shows "No items to display." in "Security Response" box and many "Unknown Exceptions in" are being placed in the scm.server.log.
http://www.symantec.com/docs/TECH96946

sandra

Ok, once again, the solution is to connect it to the internet in which we can't do.  Are there any other solutions to have this error message stop?  Is there a way get this information from LiveUpdate Administrator?

As the document says, if there's no connection, the message will continue to display. There doesn't seem to be any way to suppress it. What are the parameters by which the notification sends you mail?

LUA handles content (files to download and distribute). It doesn't handle hosting html pages (which is what the SEPM is trying to reach out to get).

sandra

We have email alerts for our PM that sends a message if it detects a FATAL error and above to email.  This is showing up as a fatal error.  They come in at like 200 at a time every hour or so.  This also fills up the log where this is stored and deletes potential needed information.

Hello,

These messages generally indicate that the SEPM is not able to access current Symantec threat information over an Internet connection.  Here's the official article on the subject:

Symantec Endpoint Protection Manager homepage displays the following error:"No data, ..." in "Security Response" box and Severe with failing to load up the INDEXW.html file status under the logs session when running a report for server activity. (http://www.symantec.com/docs/TECH97386)

Please let the forum know if this solved your issue or if there is anything additional we can do to help!

Yes, this is the exact issue we are having.  However, are you saying that there is no way to stop these messages from flooding the logs?  So the solution is ignore them because this is by design?  I understand the reasoning, but I still feel that this is an un-acceptable solution.  Is there a way to submit this to engineering to take a look at?  Maybe add a check box that says there is no internet connection available to stop trying and logging this event?

Thanks.

Mithun, that's pretty much what I already said.

If there were a way to disable or suppress this notification in a case where there is no internet connection, believe me, I'd share it. With no internet connection, these messages are expected behaviour.

sandra

I think you can submit it is as an Idea in the idea section of this form so that the Symantec developers will look into it.

I would suggest investigating the Ideas section. This is the closest I could find to your issue.

https://www-secure.symantec.com/connect/idea/management-servers-getting-security-response-data-another-management-server-rather-allowing-all

sandra