Endpoint Protection Small Business Edition

Hi,

we have a server 2003 with a termial server installed on it. The problem is the terminal server is not reporting back to the managment console thus no updates downloaded. Live update is not working cos there is no internet access from the terminal server. SEP version 11.0.5002.333. I can telnet to the managment server using the correct port using this link: http://servername:port/secars/secars?hello,secars and I got 4 squares instead of OK!

Regards,

ForceMan<o p=""></o>

 

Hi,

Are you getting these boxes when you do the secars test from a differene machine as well?

Lets isolate the issue here. If secars is Ok on a different machine, then the issue is with the termnal server. Please run the sylinkmonitor tool and paste the logs here. http://www.symantec.com/connect/articles/how-capture-sep-sepm-communication-logs-sylinkmonitor-mr3-onwards-troubleshooting-communica

Do  a "ping localhost" in command prompt and let us know if you find anything wierd there.

Aniket

Hi,

Thanks for the quick reply. Here is the result of the Syslink:

11/05 09:01:07 [5768] <CheckHeartbeatTimer>====== Heartbeat loop starts at 09:01:07 ======
11/05 09:01:07 [5768] <GetOnlineNicInfo>:Netport Count=1
11/05 09:01:07 [5768] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="IP address" Mac="00-0b-cd-9b-bb-53" Gateway="IP address" SubnetMask="255.255.224.0"/></SSANICs>
11/05 09:01:07 [5768] <CalcAgentHashKey>:CH=E010236C0AE8290501DA93E0866A16BA1iemts01domain.localF0B4924D41FCFF4A9886CB17002FC72B
11/05 09:01:07 [5768] <CalcAgentHashKey>:CHKey=17D8DF4CD9A9615F438A1390AE9BA440
11/05 09:01:07 [5768] <CalcAgentHashKey>:C=E010236C0AE8290501DA93E0866A16BA1iemts01domain.local
11/05 09:01:07 [5768] <CalcAgentHashKey>:CKey=0531ACE016D2B2DF9E2D52CAB0C1486A
11/05 09:01:07 [5768] <CalcAgentHashKey>:UCH=E010236C0AE8290501DA93E0866A16BA0k056LocalComputeriemts01domain.localF0B4924D41FCFF4A9886CB17002FC72B
11/05 09:01:07 [5768] <CalcAgentHashKey>:UCHKey=700226BE989F4890FEA535D2012E6CA5
11/05 09:01:07 [5768] <CalcAgentHashKey>:UC=E010236C0AE8290501DA93E0866A16BA0k056LocalComputeriemts01domain.local
11/05 09:01:07 [5768] <CalcAgentHashKey>:UCKey=9AD92E4DFBDFA241A202873F29EE70FC
11/05 09:01:07 [5768] <DoHeartbeat>HardwareID=F0B4924D41FCFF4A9886CB17002FC72B
11/05 09:01:07 [5768] <DoHeartbeat>CHKey=17D8DF4CD9A9615F438A1390AE9BA440
11/05 09:01:07 [5768] <DoHeartbeat>CKey=0531ACE016D2B2DF9E2D52CAB0C1486A
11/05 09:01:07 [5768] <DoHeartbeat>UCHKey=700226BE989F4890FEA535D2012E6CA5
11/05 09:01:07 [5768] <DoHeartbeat>UCKey=9AD92E4DFBDFA241A202873F29EE70FC
11/05 09:01:07 [5768] <DoHeartbeat> Set heartbeat event
11/05 09:01:07 [5768] Use new configuration
11/05 09:01:07 [5768] <CSyLink::IndexHeartbeatProc()>
11/05 09:01:07 [5768] <IndexHeartbeatProc> Got ConfigObject to proceed the operation.. pSylinkConfig: 010CD9E8
11/05 09:01:07 [5768] <IndexHeartbeatProc>====== Reg Heartbeat loop starts at 09:01:07 ======
11/05 09:01:08 [5768] HEARTBEAT: Check Point 1
11/05 09:01:08 [5768] Get First Server!
11/05 09:01:08 [5768] <GetFirstSEMServer> Selecting a random server
11/05 09:01:08 [5768] HEARTBEAT: Check Point 2
11/05 09:01:08 [5768] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
11/05 09:01:08 [5768] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
11/05 09:01:08 [5768] HEARTBEAT: Check Point 3
11/05 09:01:08 [5768] <IndexHeartbeatProc>Setting the session timeout on Profile Session to 30000
11/05 09:01:08 [5768] HEARTBEAT: Check Point 4
11/05 09:01:08 [5768] <IndexHeartbeatProc>===Get Index STAGE===
11/05 09:01:08 [5768] ************CSN=594
11/05 09:01:08 [5768] <mfn_MakeGetIndexUrl:>Request is: action=12&hostid=85572AB10AE829050106433D6956FD7E&chk=17D8DF4CD9A9615F438A1390AE9BA440&ck=0531ACE016D2B2DF9E2D52CAB0C1486A&uchk=700226BE989F4890FEA535D2012E6CA5&uck=9AD92E4DFBDFA241A202873F29EE70FC&hid=F0B4924D41FCFF4A9886CB17002FC72B&groupid=E010236C0AE8290501DA93E0866A16BA&mode=0&hbt=300&as=594&cn=[hex]69656D74733031&lun=[hex]6B303536&udn=[hex]4C6F63616C436F6D7075746572
11/05 09:01:08 [5768] <GetIndexFileRequest:>http://AV servername:80/secars/secars.dll?h=9F95F97805625C4DEC30C1C03CDBB221BF4AC4BC031C6B660CBD16D7E53D8E880636DAE266445B9A702BC9B91FEFF4520CC9A46EDA465066AC3728066F1F499A7D094829132E48678FE65420CB09345071A9619051A9D32E75C107BBFA6B13F8666C1F8FC7E67854F3D061CA76D418BB376ED6543F1839C4B64573C95A821FE14E23E42C85B5004147C8D7566D59E2CE4EA9138EBE4F655B60875F8DE5FD241C2ED257D686EB283563E5456C8D19760F75B80B1F302E4D139AA8A3C7CD33A7D8E93BB6AFBE5D0A61A1FA1E84F7B9F129A96D831D8DFC218522D6F956F202492E5B307CFA2BD6E6DDD8784FC7A14616222BBC0B4ECE6DCC3F63110F58CD1C16E59B02EC845CC9758B7E286D9E3BE62B0B900BEA005A0C253022EF3DED9D7EC953FB75CB7E4FE7AD2F9133269911EF78C88C2302A39B57D15C40F828EB85B50081F821C3672A4D1C51ACC7F3C5861035EF2331F43B93E35C544F427276C08C60A0DA74307604970710E5FB7217C4F9B7BDB6FB4FD3EF623290EF5FB4860F7503F7
11/05 09:01:08 [5768] <GetIndexFileRequest:>SMS return=503
11/05 09:01:08 [5768] <ParseHTTPStatusCode:>503=>503 SERVICE NOT AVAILABLE
11/05 09:01:08 [5768] HTTP returns status code=503
11/05 09:01:08 [5768] <GetIndexFileRequest:>RECEIVE STAGE COMPLETED
11/05 09:01:08 [5768] <GetIndexFileRequest:>COMPLETED
11/05 09:01:08 [5768] <IndexHeartbeatProc>GetIndexFile handling status: 503
11/05 09:01:08 [5768] <IndexHeartbeatProc>Switch Server flag=1
11/05 09:01:08 [5768] HEARTBEAT: Check Point 5.1
11/05 09:01:08 [5768] <ScheduleNextUpdate>new scheduled heartbeat=1024 seconds
11/05 09:01:08 [5768] HEARTBEAT: Check Point 8
11/05 09:01:08 [5768] Get Next Server!
11/05 09:01:08 [5768] <IndexHeartbeatProc>switch to another server
11/05 09:01:08 [5768] <DecrementScheduleTime:>New scheduled heartbeat=512 seconds
11/05 09:01:08 [5768] HEARTBEAT: Check Point 1
11/05 09:01:08 [5768] HEARTBEAT: Check Point 2
11/05 09:01:08 [5768] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
11/05 09:01:08 [5768] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
11/05 09:01:08 [5768] HEARTBEAT: Check Point 3
11/05 09:01:08 [5768] <IndexHeartbeatProc>Setting the session timeout on Profile Session to 30000
11/05 09:01:08 [5768] HEARTBEAT: Check Point 4
11/05 09:01:08 [5768] <IndexHeartbeatProc>===Get Index STAGE===
11/05 09:01:08 [5768] ************CSN=595
11/05 09:01:08 [5768] <mfn_MakeGetIndexUrl:>Request is: action=12&hostid=85572AB10AE829050106433D6956FD7E&chk=17D8DF4CD9A9615F438A1390AE9BA440&ck=0531ACE016D2B2DF9E2D52CAB0C1486A&uchk=700226BE989F4890FEA535D2012E6CA5&uck=9AD92E4DFBDFA241A202873F29EE70FC&hid=F0B4924D41FCFF4A9886CB17002FC72B&groupid=E010236C0AE8290501DA93E0866A16BA&mode=0&hbt=300&as=595&cn=[hex]69656D74733031&lun=[hex]6B303536&udn=[hex]4C6F63616C436F6D7075746572
11/05 09:01:08 [5768] <GetIndexFileRequest:>http://AV server IP:80/secars/secars.dll?h=9F95F97805625C4DEC30C1C03CDBB221BF4AC4BC031C6B660CBD16D7E53D8E880636DAE266445B9A702BC9B91FEFF4520CC9A46EDA465066AC3728066F1F499A7D094829132E48678FE65420CB09345071A9619051A9D32E75C107BBFA6B13F8666C1F8FC7E67854F3D061CA76D418BB376ED6543F1839C4B64573C95A821FE14E23E42C85B5004147C8D7566D59E2CE4EA9138EBE4F655B60875F8DE5FD241C2ED257D686EB283563E5456C8D19760F75B80B1F302E4D139AA8A3C7CD33A7D8E93BB6AFBE5D0A61A1FA1E84F7B9F129A96D831D8DFC218522D6F956F202492E5B307CFA2BD6E6DDD8784FC7A14616222BBC0B4ECE6DCC3F63110F58CD1C16E59B02EC845CC9758B7E286D9E3BE62B0B900BEA005A0C253022EF3DED9D7EC9534E2850DF4D7ED98050B7810FFD6952E58C2302A39B57D15C40F828EB85B50081F821C3672A4D1C51ACC7F3C5861035EF2331F43B93E35C544F427276C08C60A0DA74307604970710E5FB7217C4F9B7BDB6FB4FD3EF623290EF5FB4860F7503F7
11/05 09:01:08 [5768] <GetIndexFileRequest:>SMS return=503
11/05 09:01:08 [5768] <ParseHTTPStatusCode:>503=>503 SERVICE NOT AVAILABLE
11/05 09:01:08 [5768] HTTP returns status code=503
11/05 09:01:08 [5768] <GetIndexFileRequest:>RECEIVE STAGE COMPLETED
11/05 09:01:08 [5768] <GetIndexFileRequest:>COMPLETED
11/05 09:01:08 [5768] <IndexHeartbeatProc>GetIndexFile handling status: 503
11/05 09:01:08 [5768] <IndexHeartbeatProc>Switch Server flag=1
11/05 09:01:08 [5768] HEARTBEAT: Check Point 5.1
11/05 09:01:08 [5768] <ScheduleNextUpdate>new scheduled heartbeat=1024 seconds
11/05 09:01:08 [5768] HEARTBEAT: Check Point 8
11/05 09:01:08 [5768] Get Next Server!
11/05 09:01:08 [5768] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
11/05 09:01:08 [5768] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
11/05 09:01:08 [5768] <IndexHeartbeatProc>====== IndexHeartbeat Procedure stops at 09:01:08 ======
11/05 09:01:08 [5768] <IndexHeartbeatProc>Set Heartbeat Result= 1
11/05 09:01:08 [5768] <IndexHeartbeatProc>Sylink Comm.Flags: 'Connection Failed' = 1, 'Using Backup Sylink' = 1, 'Using Location Config' = 0
11/05 09:01:08 [5768] <IndexHeartbeatProc>Connection Failed! No. of tries = 2
11/05 09:01:08 [5768] Use new configuration
11/05 09:01:08 [5768] HEARTBEAT: Check Point Complete
11/05 09:01:08 [5768] <IndexHeartbeatProc>Done, Heartbeat=1024seconds
11/05 09:01:08 [5768] </CSyLink::IndexHeartbeatProc()>
11/05 09:01:08 [5768] <CheckHeartbeatTimer>====== Heartbeat loop stops at 09:01:08 ======
11/05 09:01:23 [9456] <CSyLink::mfn_DownloadNow()>
11/05 09:01:23 [9456] </CSyLink::mfn_DownloadNow()>

Sorry for the long post I dont know if I can upload files.
Ping localhost nothing wierd there..... I have tried http://servername:port/secars?hello,secars from different machines and I got the same result actually so none of them using the management server but since they have internet they get the updates from there.

Regards,

ForceMan

Troubleshooting Client Communication 

Hi,

HTTP 503 error can mainly be caused if the appliacation pool at the server has stopped. On the SEPM server, please go to start->run->inetmgr->ok

In IIS manager, expand application pool. Make sure that all of them are started. You can run te SEP support tool and see if you get any more errors other than http 503

Aniket

Hi guys,

thanks for both of you, the problem was the managment server, it is an ISA server as well and the ISA part got broken and that was blocking the connections from the clients. After fixing it the clients are reporting back fine.

Thanks again,
ForceMan

Good to hear your problem is fixed