Hi Umit,

This is a known issue with Symantec Endpoint Protection 11.0.

I have seen a doc on symantec website long ago but still not able to locate.

Will post the same as soon as I get the link.

Rgrds,

SAM

Hi Umit,

Here is the link..

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008052011091248

The solution which I use to follow is restarting the server every 1-2 days.

Rgrds,

SAM

Umit, When you say you have 3 additional servers - are they replica servers, or just additional management servers in the same site as the other server?

I have seen issues with definition information not replicating properly, but never had different results from servers in the same site.

Hi Paul

They are only additional server and they use 1 Sql server foe writing data. But the add. servers are diffirent location.

Thanks.

This is a known issue.  Although it depends on which Symantec Tech you talk to, some have no idea about it and spin you in circles for weeks. Then you talk to someone else who quickly pulls up a doc and is like "duh, it's a known issue".  Apparently what ever server is the primary listed server, the one the clients are contacting, that server is the only one with correct up to date reporting data.

Servers in other sites, that are not normally hit by clients (such as failover servers), they will show bad reporting data and think none of your clients have definitions.

They said this will be fixed in either MR4 MP1 or MP2.  They said it wasn't high on the priority list lol.

Only answer was to login to the server that the clients are hitting. 

Rob,

I agree that the issue exists with replicated sites, but it should not be present with SEPM's in the same SEPM site.  They are querying the same DB, with the same query.  I have several installations at customer sites who have multiple servers and all return the same information.  Can you confirm you do NOT have replication running?

Hello all,

Umit and I are working on this issue together. We're both trying to do our bests to resolve this, and I will try to seek for help here with him.

Yes Paul, there's no replication. 4 servers in one site and 1 SQL 2005 server.

I have a silly question but people who know the infrastructure may come up with something. While we were working on the site about this issue, we suddenly wanted to try to delete one of the problematic clients from the server, expecting it to reconnect. Before the deletion, the client had a green dot on both ends but definition, last scan, last policy etc. info was wrong. After the deletion, within a few minutes, client showed back up with a green dot. But we were seeing "client not reporting status" message in the related columns. And after a few more minutes, those columns were filled correctly. We were so happy, thinking of applying this to all problematic clients.

And we did so. We massively removed those clients with old information from the SEP manager.Then, they reconnected as expected.But, although it's a been 4 days now, they still have the "client not reporting status" messages. Was it wrong to delete tens of clients so quickly?

What else would you guys think of to do? Thanks.

Hello Everyone ;

Any news ?

this is happening to me as well.. with MR 3 .. some clients says Not reporting status, and not updating the defination files as well.. did anyone found any resolution for this ?

Same thing here; some clients says Not reporting status, and not updating the defination files as well

Even after upgrade to MR4...

Any ideas?

Same thing...

We use MR4 few months without problems, but this problem occured...???

no reply, i think no one is able to fix this problem will go ahead n open a high priority case

No use Aussie. Tishko put everyone into this. Even engineers who are non-support guys and even developers. It's been months and we (almost 15 advanced SEP people) couldn't resolve it.

Something is messed up with MR3 and  upgrade to MR4 doesn't resolve it. But a fresh clean MR4 installation shouldn't have done it, however there are people complaining about it as well. I think Symantec should find what is wrong with the clients and release a patch immediately. That's why we're not doing a fresh install, to let them find what is wrong.

It's frustrating isn't it ? :)

Tech support spend some time on the issue. Ultimately uninstalling and subsequently reinstalling the SQL client tools and running through the server config wizard and rebooting the server appears to have solved the problem. Although this was only noticable after a day or two. I must say that support was also stunned that it the problem was solved and they 're not so sure about above fix... But nothing else was done to the server. Right now, not a single client shows up as "NOT REPORTING STATUS" and the AGENTINFO folder is not piled wat dat-files anymore.

I hope this helps other in solving their issues!

Dries

As the owner of the topic, we resolved this issue. But i think it was specific to us. Someone in the DC technicians group made a move within the group policy without our permisson. And that move somehow blocked some of the SEP clients from logging down the AV logs. So we wouldn't see their latest AV status on the dashboard. Now the problem is gone. So funny and irritating since we were trying to resolve it for 3 months.

Thanks anyway.