Endpoint Protection

Today is just not my day.

Tried logging into SEPM console (directly on the server) and it hangs up at the "Logging on to the management server" "This may take several seconds" screen. After restarting the server, IISreset, reinstalling Java and even reconfiguring the management server to use port 8440 instead of 8443, I noticed that the Endpoint Protection client is showing as Offline.

I found that Windows updates were installed around 3am PST so I uninstalled them and rebooted. Same thing. Can't log into the console and the client is still Offline.

Any suggestions?

Have you tried this?

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008052116060648

Thomas

When I try browsing to this address: http://<server ip>:<port>/secars/secars.dll?hello,secars in IE, it just sits there waiting and trying to connect.

Check the logs, you should get some indication of errors in scm-server-0.log. If you see an error like "connection refused", then you should check the ODBC connectivity.

If you see errors that have HTTP mentioned, you should check the IIS manager for configuration.

Please try these steps :-

1) Open IIS Manager.
2) Right click on symantec websrver and select properties.
3) Click on directory security and click on the first edit tab.
4) Check the permissions for the IUSR account and then restart the IIS Admin service.

Important : The IUSR account should be of the local machine.

Hi,

Is is possible for you to attach scm server o.log and catalina.out log files.

These files will be located under C:\(drive where SEPM is installed) \Program files\Symatec\Symantec Endpoint Protection Manager\tomcat\logs.

...Barkha

scm-server-0.log
2009-05-15 10:35:25.281 SEVERE: ================== Server Environment ===================
2009-05-15 10:35:25.281 SEVERE: os.name = Windows 2003
2009-05-15 10:35:25.281 SEVERE: os.version = 5.2
2009-05-15 10:35:25.281 SEVERE: os.arch = x86
2009-05-15 10:35:25.281 SEVERE: java.version = 1.5.0_15
2009-05-15 10:35:25.281 SEVERE: java.vendor = Sun Microsystems Inc.
2009-05-15 10:35:25.296 SEVERE: java.vm.name = Java HotSpot(TM) Server VM
2009-05-15 10:35:25.296 SEVERE: java.vm.version = 1.5.0_15-b04
2009-05-15 10:35:25.296 SEVERE: java.home = C:\Program Files\Symantec\Symantec Endpoint Protection Manager\jdk\jre
2009-05-15 10:35:25.296 SEVERE: catalina.home = C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat
2009-05-15 10:35:25.296 SEVERE: java.user = null
2009-05-15 10:35:25.296 SEVERE: user.language = en
2009-05-15 10:35:25.296 SEVERE: user.country = US
2009-05-15 10:35:25.296 SEVERE: scm.server.version = 11.0.4014.26


catalina.out
May 15, 2009 10:35:22 AM org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-9090
May 15, 2009 10:35:23 AM org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-8440
Starting service SCM
Apache Tomcat/4.1.37-LE-jdk1.4
Has valid SAV license
Info>> No SNAC license file in C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\license
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: ================== Server Environment ===================
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: os.name = Windows 2003
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: os.version = 5.2
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: os.arch = x86
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.version = 1.5.0_15
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.vendor = Sun Microsystems Inc.
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.vm.name = Java HotSpot(TM) Server VM
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.vm.version = 1.5.0_15-b04
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.home = C:\Program Files\Symantec\Symantec Endpoint Protection Manager\jdk\jre
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: catalina.home = C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.user = null
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: user.language = en
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: user.country = US
May 15, 2009 10:35:25 AM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: scm.server.version = 11.0.4014.26

Liton, I have restarted the IIS Admin service several times and no change.

Something else has to be wrong because the installed SEP client on that same server is showing Offline and it even reports to that server.

I downloaded and ran the Symantec Endpoint Protection Support Tool v1.0.1050

First error is:
"Can SEP communicate with its SEPM?"
Error: The Secars communication test failed for these consoles:
It lists all of my SEPM servers and Port 8014 for them, also Http code 503. One of the servers has error "A connection with the server could not be established.

Anybody have any ideas?

Hello???

Hi,

here's some suggestions:

1) Enable the finest logging level:
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007090612034148
2) check if the Symantec Endpoint Protection Manager is running, it is likely stopped
3) if it stopped try to start it and check if it stays in the running status (press F5 to refresh the status of the services)
 a) if it stays started, try to log on and check again the service status
4) When you see that the service crashed again or the log on does not complete, go to the SEPM\tomcat\logs, sort them by the modified date and go through the latest modified logs

Here's more details about the http error 503:
http://support.microsoft.com/?scid=kb%3Ben-us%3B318380&x=21&y=12
http://support.microsoft.com/?scid=kb%3Ben-us%3B820729&x=10&y=12

Regards,

The modified logs didn't help!

See this KB regarding the 503 error code.

http://service1.symantec.com/support/ent-security.nsf/docid/2008102314514748

Cycletech, I've checked that before and it's been set to Unlimited since the servers were created. It's only been since last Wednesday that the problems arose.

I've uninstalled Windows updates that were applied and none of them are the problem. I had two servers, out of the 6, that were still working. Some time today, 1 of those has also now stopped working.

I'm at wits end with SEP. I have had nothing but headaches since the first time I started testing it. We should have stuck with SAV 10 and forced Symantec to continue supporting it until they got SEP right.

BadAndy,

I hear your pain. I recommend you open a case wilh Symantec support. We can get this resolved for you.

Thomas

I opened a case yesterday but their solution was to uninstall SEPM and reinstall it. Did not work.

I got curious to see what kind of traffic was being passed between the servers and the SQL db so I emailed out DBA and the log she sent me showed that only 1 of the SEPM servers was really touching the db. This morning I check the activity monitor in the SQL server management console and found that one of the "broken" servers was being blocked by some other process. I got a little ahead of myself and killed all of the SEP related processes and they started working again, surprisingly.

It still doesn't explain why this all started though. I didn't find anything in the logs on the SQL server or on any of the SEPM servers to show that it was a problem at the SQL server. The ODBC connections on the SEPM servers all tested fine.