Endpoint Protection

Hi guys,
From few days I'm getting from my SEP 11 emails like this:

Number of system events detected: 16 898 System events included:
Server,
Replication,
Backup/Restore,
Errors.

Inside report I see errors like:

An unexpected exception has occurred
D:\SEPM\data\inbox\learnedapp\computerapp\0c9a27f7-5118-4d00-bae9-27ae2c8714a7.dat (The system cannot find the file specified)

Server is running normally for some time, but after few hours (usually about 12) it will stop responding to clients requests, stop distributing updates, reporting seem to work but nothing is updated in reports.
I need to do iisreset or sometimes reboot server to get back all functionality.

SEPM version is MR4 MP2, about 850 clients.
Machine is dual Xeon 2.00 Ghz with 4GB RAM.

I opened a case with support, but they keep sending me links to articles I already seen instead of any serious log analysis.

Any input appreciated.

hi,
Did you happen to check for th eevent id associated with the error during this time around 12AM/PM.

Also did you happen to check for the scm-server-0.log? This will give more insight about the issue.

Cheers

Pete

Hi Pete,
Windows Event Log seem to be clean. I attached scm server log. Unfortunatelly I can't tell too much from it.

Chris

check urs IIS .

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/4bd90f7f0f5b95c18825738c00660e10?OpenDocument

Hi Chris,

I did go through the logs, there are some errors I could see like "
"2009-07-14 14:09:45.945 SEVERE: Schedule is stopped!
2009-07-14 14:09:45.960 SEVERE: Schedule is started!
2009-07-14 14:09:48.085 SEVERE: AgentOnlineStatusTask connect to secars failed: SERVICE NOT AVAILABLE"

for this message the link by Randy P will be good to go.


generateDeltaContent FAILED 2"
wondering why the inetpub in the logs shows "D:\SEPM\tomcat\..\Inetpub\DeltaParam\{C60DC234-65F9-4674-94AE-62158EFCA433" instead of someting like "Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub" it should not have been in SEPM\tomcat\


good luck. Please update us on the outcome from support suggestion as well.

Pete