hi all,

the workstations are not getting virus update even if it online. We are facing this issue from past one week. All the machince are in 11.0.6.xxx version.

I tried updating content from console but didnt wok out. Please advise on this.

Does a machine update if you run LiveUpdate locally?

Is the client connecting to the SEPM?

Enable sylink logging and post the log here

hello,

how many system having problem ?

Please confirm how your clients are getting updates from ? from internet or from SEPM?

if its from SEPM check if your clients are communicating with the Manager and manager has latest udpates.

to check if they are communicating open the client interface- click on help and support - troubleshooting, do you see server name?

to check if sepm has latest defs, open sepm

admin -servers - under liveupdate click show updates.

Hi,

Kindly provide sylink logs

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

Symantec Endpoint Protection Manager 11.x is not updating 32 or 64 bit virus definitions.

hi,

Around 1500 workstaions have this problem

The clients are getting updates from SEPM, clients are communicating with manager and SEPM has latest update

May be the definition on sepm server is corrupted. Try to remove and check client getting update

if the definition is corrupted then servers also not able to get update but from our console servers are getting updated but not workstation

This version 11.0.6.xxx had lot of issues with updates. Please upgrade to latest version at the earliest.

the manager might not be downloading the lastest 32 bit but might be downloading 64 bit defs.

check post the sylink logs

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

http://www.symantec.com/docs/TECH104758

Hello,

May be your update Server updated defintion is corrupted, so that not getting update on clients, so try the one time to clean it on server. Hope it will help you.

If clients are communicating well then check your client whether are having sufficient free space to install new definition, also there may be posibilities that client are corrupted or existing definition is courrupted.

Hi,

Can you try the following steps?

1) Repair the Symantec Endpoint Protection Manager (SEPM) using add/remove programs or with the help of original setup files

2) Can reboot the server during non production hours.

Hello,

In your case, please let us know when was the last time you restarted the Server machine? Try restarting the Server machine and check if that helps.

Secondly, since all the 1500 client machines are not receiving the definitions, this clearly indicates issues on the SEPM machine. 

Is there any Firewall or Proxy which has been setup? 

Were there any changes made on the server or the network which could have caused this issue?

I would suggest you to upload us the Sylink.log from 1 or 2 client machines which are not updating the definitions - 

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

http://www.symantec.com/docs/TECH104758

You could also try running the SymHelp Utility - 

Troubleshooting computer issues with the Symantec Help support tool

http://www.symantec.com/docs/HOWTO80839

About the new SymHelp tool for SEP 12.1RU2

https://www-secure.symantec.com/connect/articles/about-new-symhelp-tool-sep-121

Hope that helps!!

Run the SymHelp tool on an affected client to check for errors

Symantec Help (SymHelp) Download

hi All,

here is the sylink log from one of the client which is not updating definition

05/15 12:23:14 [3744] ~~~Sylink log started. (SEP Product Version in registry: 11.0.6000.550, Sylink File Version: 11.0.6000.436)
05/15 12:23:14 [3744] Stored HostGUID=6697610E0A0A0196019845FB2578159E; outlen=16
05/15 12:23:14 [3744] <RestoreSettings>Stored UserGuid=0; outlen=2
05/15 12:23:14 [3744] <mfn_DecodeSSN>Sygate-SSN=9073
05/15 12:23:14 [3744] <mfn_DecodeSSN>Read CSN=9074
05/15 12:23:14 [3744] <mfn_DecodeSSN>Sygate-SSN=1267
05/15 12:23:14 [3744] <mfn_DecodeSSN>Read CSN=1268
05/15 12:23:14 [3744] Product Type=1,Major Ver=5,Minor Ver=1,Platform ID=2,OSType=17105154
05/15 12:23:14 [3744] OS=Windows XP Professional ; number=5.1.2600
05/15 12:23:14 [3744] SyLinkCreateInstance => Instance created: 01CD3FF8 Registry path: SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK
05/15 12:23:14 [3744] <GetOnlineNicInfo>:Netport Count=1
05/15 12:23:14 [3744] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="10.20.137.54" Mac="00-22-64-b2-c5-ca" Gateway="10.20.137.1" SubnetMask="255.255.255.0"/></SSANICs>
05/15 12:23:14 [3744] SyLinkCreateConfig => Created instance: 01CF2D68
05/15 12:23:14 [3744] UseNewConfig => Created m_hNewConfig: 01CF2D68
05/15 12:23:14 [3744] Importing ConfigObject: 01CD2D50 into: 01CF2D68
05/15 12:23:14 [3744] Importing ConfigObject: 01CD2D50 into: 01CF1AC0
05/15 12:23:14 [3744] <PostEvent>stopping...ignore event ID=EVENT_SYLINK_CONFIG_SETTING_CHANGED
05/15 12:23:14 [3744] SSA packageType is set as 105
05/15 12:23:14 [3744] SyLinkDeleteConfig => Deleting instance: 01CD2D50
05/15 12:23:15 [3744] <SetHiStatus>HI status is changed to=3; reason=105; rule=Host Integrity check is disabled.
 Host Integrity policy has been disabled by the administrator.
05/15 12:23:15 [3744] SyLinkCreateConfig => Created instance: 02E5DF08
05/15 12:23:15 [3744] SetCurLocationName: Name is set to - Default
05/15 12:23:15 [3744] SetCurLocationID: ID is set to - BD58D6110A0A01E401B22ABCBDEE612C
05/15 12:23:15 [3744] SyLinkCreateConfig => Created instance: 02E5F1B0
05/15 12:23:15 [3744] RemeberCurrentGroup=0,RememberCurrentPolicyMode=0
05/15 12:23:15 [3744] Importing ConfigObject: 02E5F1B0 into: 01CF2D68
05/15 12:23:15 [3744] Importing ConfigObject: 02E5F1B0 into: 01CF1AC0
05/15 12:23:15 [3744] <PostEvent>stopping...ignore event ID=EVENT_SYLINK_CONFIG_SETTING_CHANGED
05/15 12:23:15 [3744] SyLinkDeleteConfig => Deleting instance: 02E5F1B0
05/15 12:23:15 [3744] SyLinkDeleteConfig => Deleting instance: 02E5DF08
05/15 12:23:15 [3744] <CSyLink::Start()>
05/15 12:23:15 [3744] <EncodeHelper::DecryptUrl>
05/15 12:23:15 [3744] <CSyLink::Start> The last server used was 'ADLUTIL02'
05/15 12:23:15 [3744] <CSyLink::ImportConfigFile()>
05/15 12:23:15 [3744] CUpdateConfig::Dump
05/15 12:23:15 [3744] </CSyLink::ImportConfigFile()>
05/15 12:23:15 [3744] <GetDomainHostName>msz_DomainName is taken from szDomainName
05/15 12:23:15 [3744] <GetDomainHostName>DomainName (Final)=elderslimited.com.au
05/15 12:23:15 [3744] <HWID CSyLink::GetHardwareKey> Get Hardware ID
05/15 12:23:16 [3744] <HWID CSyLink::GetHardwareKey> Hardware ID assigned: 45E8BCABC22C54DB8324BE2A759704D0
05/15 12:23:16 [3744] <Start>Unable to create Session with 'User Proxy' settings - Proxy Server: Error Code: 87
05/15 12:23:16 [3744] <Start>Unable to create Session with 'No Proxies' settings - Error Code: 87
05/15 12:23:16 [3744] <EncodeHelper::DecryptUrl>
05/15 12:23:16 [3744] <Add2LUFileList:>Adding LU Info to LU Download File List: {C60DC234-65F9-4674-94AE-62158EFCA433}130514004
05/15 12:23:16 [3284] <ScheduleNextUpdate>Manually assigned heartbeat=13626 seconds
05/15 12:23:16 [1808] <HeartbeatThreadProc:>Thread is about to begin..
05/15 12:23:16 [3284] Successfully created the heartbeat thread
05/15 12:23:16 [3744] <Start>Started, contact SMS every 14400 seconds
05/15 12:23:16 [3744] <PostEvent>going to post event=EVENT_SYLINK_CONFIG_SETTING_CHANGED
05/15 12:23:16 [3744] <PostEvent>done post event=EVENT_SYLINK_CONFIG_SETTING_CHANGED, return=0
05/15 12:23:16 [3744] </CSyLink::Start()>
05/15 12:23:16 [3744] <SetClientAuth>Received new User/Domain from SMC..  User: X2140285 User Domain: ELDERS
05/15 12:23:16 [3744] <SetClientAuth>Getting RDNS Domain Name (user domain in AD setup)..
05/15 12:23:16 [3744] <GetLoginRdnsDomain>DNS domain=ELDERSLIMITED.COM.AU
05/15 12:23:16 [3744] <SetClientAuth>Setting the User Domain to RDNS Domain ..
05/15 12:23:16 [3744] <SetClientAuth>Logged in user info set to: ELDERSLIMITED.COM.AU/X2140285
05/15 12:23:16 [3744] <SetClientAuth>Marking User Change Notify to redo registration..
05/15 12:23:16 [1808] <CheckHeartbeatTimer>====== Heartbeat loop starts at 12:23:16 ======
05/15 12:23:17 [1808] <GetOnlineNicInfo>:Netport Count=1
05/15 12:23:17 [1808] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="10.20.137.54" Mac="00-22-64-b2-c5-ca" Gateway="10.20.137.1" SubnetMask="255.255.255.0"/></SSANICs>
05/15 12:23:17 [1808] <CalcAgentHashKey>:CH=6D0CD5DF0A0A0196009787E1C83847291ELD37192elderslimited.com.au45E8BCABC22C54DB8324BE2A759704D0
05/15 12:23:17 [1808] <CalcAgentHashKey>:CHKey=CD544A4761BA1844109D0733BA6CAAAF
05/15 12:23:17 [1808] <CalcAgentHashKey>:C=6D0CD5DF0A0A0196009787E1C83847291ELD37192elderslimited.com.au
05/15 12:23:17 [1808] <CalcAgentHashKey>:CKey=4CBB72D56540CF3A0BFAA686AB14E412
05/15 12:23:17 [1808] <CalcAgentHashKey>:UCH=6D0CD5DF0A0A0196009787E1C83847290X2140285ELDERSLIMITED.COM.AUELD37192elderslimited.com.au45E8BCABC22C54DB8324BE2A759704D0
05/15 12:23:17 [1808] <CalcAgentHashKey>:UCHKey=E1E339E068CE2A0E4BE845A099B600F2
05/15 12:23:17 [1808] <CalcAgentHashKey>:UC=6D0CD5DF0A0A0196009787E1C83847290X2140285ELDERSLIMITED.COM.AUELD37192elderslimited.com.au
05/15 12:23:17 [1808] <CalcAgentHashKey>:UCKey=62B981B45C7B254DB1CEB9A028389467
05/15 12:23:17 [1808] <DoHeartbeat>HardwareID=45E8BCABC22C54DB8324BE2A759704D0
05/15 12:23:17 [1808] <DoHeartbeat>CHKey=CD544A4761BA1844109D0733BA6CAAAF
05/15 12:23:17 [1808] <DoHeartbeat>CKey=4CBB72D56540CF3A0BFAA686AB14E412
05/15 12:23:17 [1808] <DoHeartbeat>UCHKey=E1E339E068CE2A0E4BE845A099B600F2
05/15 12:23:17 [1808] <DoHeartbeat>UCKey=62B981B45C7B254DB1CEB9A028389467
05/15 12:23:17 [1808] <DoHeartbeat> Set heartbeat event
05/15 12:23:17 [1808] Use new configuration
05/15 12:23:17 [1808] <RegHeartbeatProc>====== Reg Heartbeat loop starts at 12:23:17 ======
05/15 12:23:18 [1808] HEARTBEAT: Check Point 1
05/15 12:23:18 [1808] HEARTBEAT: Check Point 2
05/15 12:23:18 [1784] SyLinkCreateConfig => Created instance: 01C516D8
05/15 12:23:18 [1784] Importing ConfigObject: 01CF1AC0 into: 01C516D8
05/15 12:23:18 [1784] SyLinkDeleteConfig => Deleting instance: 01C516D8
05/15 12:23:18 [1808] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
05/15 12:23:18 [1808] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
05/15 12:23:18 [1808] HEARTBEAT: Check Point 3
05/15 12:23:18 [1808] <RegHeartbeatProc>Setting the session timeout on Profile Session (Registration) to 30000
05/15 12:23:18 [1808] HEARTBEAT: Check Point 4
05/15 12:23:18 [1808] <RegHeartbeatProc>===Registration STAGE===
05/15 12:23:18 [1808] <MakeRegisterData:>logon id (domain/user)=ELDERSLIMITED.COM.AU/X2140285
05/15 12:23:18 [1808] <GeneratePreferredGroupAndModeInRegistration:>Loading current group:My Company\SOE PCs\Elders Workstations
05/15 12:23:18 [1808] <GeneratePreferredGroupAndModeInRegistration:>Loading current mode:1
05/15 12:23:18 [1808] <GeneratePreferredGroupAndModeInRegistration:>Loading preferred group:My Company\SOE PCs
05/15 12:23:18 [1808] <GeneratePreferredGroupAndModeInRegistration:>Loading preferred mode:1
05/15 12:23:18 [1808] <GeneratePreferredGroupAndModeInRegistration:>It will remember nothing, PreferredGroup is My Company\SOE PCs, PreferredMode is 1
05/15 12:23:18 [1808] <MakeRegisterData:>XML data: <?xml version="1.0" encoding="UTF-8" ?><SSARegData NameSpace="rpc"><AgentInfo DomainID="6D0CD5DF0A0A0196009787E1C8384729" AgentType="105" UserDomain="ELDERSLIMITED.COM.AU" LoginUser="X2140285" ComputerDomain="elderslimited.com.au" ComputerName="ELD37192" PreferredGroup="Myompany    KSOEPCs" PreferredMode="1" HardwareKey="45E8BCABC22C54DB8324BE2A759704D0" SiteDomainName=""/>
<SSAHostInfo><NetworkIdentity UserDomain="ELDERSLIMITED.COM.AU" LogonUser="X2140285" HostDomain="elderslimited.com.au" HostName="ELD37192" HostDesc="" />
<SSAProduct Version="11.0.6000.550" />
<SSAOS Version="5.1.2600" Desc="Windows             3A1BE64PProfessional" Type="17105154" ServicePack="ServicePack"/>
<Processor ProcessorType="x86     0x1.1bf840p-965mily%20Model%20Stepping" ProcessorClock="1595" ProcessorNum="2"/>
<Memory Size="2099486720"/>
<BIOS Version="HPQOEM-"/>
<TpmDevice Id="0"/>
<SSAProfile Version="5.0.0" SerialNumber="C1BF-04-0.000000030.0000002013%3a430x0.507dd0p-102238"/>
<SSAIDS Version="" SerialNumber=""/>
<SSAUTC Bias="-600" />
<DNSs><DNS Address="10.10.1.4"/><DNS Address="10.10.1.235"/></DNSs>
<DHCPServer Address="10.20.137.1"/><SSANICs><SSANIC Ip="10.20.137.54" Mac="00-22-64-b2-c5-ca" Gateway="10.20.137.1" SubnetMask="255.255.255.0"/></SSANICs>
</SSAHostInfo>
</SSARegData>
05/15 12:23:18 [1808] <SyLink>[MakeRegisterData] registration Hardware Key=45E8BCABC22C54DB8324BE2A759704D0
05/15 12:23:18 [1808] ************Reg CSN=1269
05/15 12:23:18 [1808] <mfn_GenPostData (for Registration):>Request is: s_origin_length: 1303
s_session_id: 45E8BCABC22C54DB8324BE2A759704D0
Sygate-SSN: 1269
<?xml version="1.0" encoding="UTF-8" ?><SSARegData NameSpace="rpc"><AgentInfo DomainID="6D0CD5DF0A0A0196009787E1C8384729" AgentType="105" UserDomain="ELDERSLIMITED.COM.AU" LoginUser="X2140285" ComputerDomain="elderslimited.com.au" ComputerName="ELD37192" PreferredGroup="Myompany    KSOEPCs" PreferredMode="1" HardwareKey="45E8BCABC22C54DB8324BE2A759704D0" SiteDomainName=""/>
<SSAHostInfo><NetworkIdentity UserDomain="ELDERSLIMITED.COM.AU" LogonUser="X2140285" HostDomain="elderslimited.com.au" HostName="ELD37192" HostDesc="" />
<SSAProduct Version="11.0.6000.550" />
<SSAOS Version="5.1.2600" Desc="Windows             3A1AB6CPProfessional" Type="17105154" ServicePack="ServicePack"/>
<Processor ProcessorType="x86     0x1.1ac8c0p-965mily%20Model%20Stepping" ProcessorClock="1595" ProcessorNum="2"/>
<Memory Size="2099486720"/>
<BIOS Version="HPQOEM-"/>

<TpmDevice Id="0"/>
<SSAProfile Version="5.0.0" SerialNumber="C1BF-04-0.000000030.0000002013%3a430x0.507dd0p-102238"/>
<SSAIDS Version="" SerialNumber=""/>
<SSAUTC Bias="-600" />
<DNSs><DNS Address="10.10.1.4"/><DNS Address="10.10.1.235"/></DNSs>
<DHCPServer Address="10.20.137.1"/><SSANICs><SSANIC Ip="10.20.137.54" Mac="00-22-64-b2-c5-ca" Gateway="10.20.137.1" SubnetMask="255.255.255.0"/></SSANICs>
</SSAHostInfo>
</SSARegData>
05/15 12:23:18 [1808] <SendRegistrationRequest:>http://ADLUTIL02:8014 [encrypted data]
05/15 12:23:20 [1808] <SendRegistrationRequest:>SMS return=200
05/15 12:23:20 [1808] <ParseHTTPStatusCode:>200=>200 OK
05/15 12:23:20 [1808] <SendRegistrationRequest:>Content Lenght => 350
05/15 12:23:20 [1808] HTTP returns status code=200
05/15 12:23:20 [1808] <SendRegistrationRequest:>RECEIVE STAGE COMPLETED
05/15 12:23:20 [1808] <SendRegistrationRequest:>COMPLETED, returned 0
05/15 12:23:20 [1808] <IsInClientIPorOnLink> NextHop Not equal 10.10.1.150,return FALSE
05/15 12:23:20 [1808] <IsInClientIPorOnLink> NextHop is OnLink with 10.20.137.54,return TRUE
05/15 12:23:20 [1808] <mfn_GetOutIP> Next Hop IP is a local IP or ONLINK:10.20.137.54
05/15 12:23:20 [1808] HEARTBEAT: Check Point 5.1
05/15 12:23:20 [1808] <ScheduleNextUpdate>Manually assigned heartbeat=3 seconds
05/15 12:23:20 [1808] <PostEvent>going to post event=EVENT_SERVER_ONLINE
05/15 12:23:20 [1808] <PostEvent>done post event=EVENT_SERVER_ONLINE, return=0
05/15 12:23:20 [1808] HEARTBEAT: Check Point 8
05/15 12:23:20 [1808] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
05/15 12:23:20 [1808] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
05/15 12:23:20 [1808] <RegHeartbeatProc>====== Registration Procedure stops at 12:23:20 ======
05/15 12:23:20 [1808] HEARTBEAT: Check Point 10
05/15 12:23:20 [1808] HEARTBEAT: Check Point Complete
05/15 12:23:20 [1808] <RegHeartbeatProc>Done, Heartbeat=3seconds
05/15 12:23:20 [1808] <CheckHeartbeatTimer>====== Heartbeat loop stops at 12:23:20 ======
05/15 12:23:24 [1808] <CheckHeartbeatTimer>====== Heartbeat loop starts at 12:23:24 ======
05/15 12:23:25 [1808] <GetOnlineNicInfo>:Netport Count=1
05/15 12:23:25 [1808] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="10.20.137.54" Mac="00-22-64-b2-c5-ca" Gateway="10.20.137.1" SubnetMask="255.255.255.0"/></SSANICs>
05/15 12:23:25 [1808] <CalcAgentHashKey>:CH=6D0CD5DF0A0A0196009787E1C83847291ELD37192elderslimited.com.au45E8BCABC22C54DB8324BE2A759704D0
05/15 12:23:25 [1808] <CalcAgentHashKey>:CHKey=CD544A4761BA1844109D0733BA6CAAAF
05/15 12:23:25 [1808] <CalcAgentHashKey>:C=6D0CD5DF0A0A0196009787E1C83847291ELD37192elderslimited.com.au
05/15 12:23:25 [1808] <CalcAgentHashKey>:CKey=4CBB72D56540CF3A0BFAA686AB14E412
05/15 12:23:25 [1808] <CalcAgentHashKey>:UCH=6D0CD5DF0A0A0196009787E1C83847290X2140285ELDERSLIMITED.COM.AUELD37192elderslimited.com.au45E8BCABC22C54DB8324BE2A759704D0
05/15 12:23:25 [1808] <CalcAgentHashKey>:UCHKey=E1E339E068CE2A0E4BE845A099B600F2
05/15 12:23:25 [1808] <CalcAgentHashKey>:UC=6D0CD5DF0A0A0196009787E1C83847290X2140285ELDERSLIMITED.COM.AUELD37192elderslimited.com.au
05/15 12:23:25 [1808] <CalcAgentHashKey>:UCKey=62B981B45C7B254DB1CEB9A028389467
05/15 12:23:25 [1808] <DoHeartbeat>HardwareID=45E8BCABC22C54DB8324BE2A759704D0
05/15 12:23:25 [1808] <DoHeartbeat>CHKey=CD544A4761BA1844109D0733BA6CAAAF
05/15 12:23:25 [1808] <DoHeartbeat>CKey=4CBB72D56540CF3A0BFAA686AB14E412
05/15 12:23:25 [1808] <DoHeartbeat>UCHKey=E1E339E068CE2A0E4BE845A099B600F2
05/15 12:23:25 [1808] <DoHeartbeat>UCKey=62B981B45C7B254DB1CEB9A028389467
05/15 12:23:25 [1808] <DoHeartbeat> Set heartbeat event
05/15 12:23:25 [1808] Use new configuration
05/15 12:23:25 [1808] <CSyLink::IndexHeartbeatProc()>
05/15 12:23:25 [1808] <IndexHeartbeatProc> Got ConfigObject to proceed the operation.. pSylinkConfig: 01CF1AC0
05/15 12:23:25 [1808] <IndexHeartbeatProc>====== Reg Heartbeat loop starts at 12:23:25 ======
05/15 12:23:25 [1808] HEARTBEAT: Check Point 1
05/15 12:23:25 [1808] Get First Server!
05/15 12:23:25 [1808] HEARTBEAT: Check Point 2
05/15 12:23:25 [1808] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
05/15 12:23:25 [1808] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
05/15 12:23:25 [1808] HEARTBEAT: Check Point 3
05/15 12:23:25 [1808] <IndexHeartbeatProc>Setting the session timeout on Profile Session to 30000
05/15 12:23:25 [1808] HEARTBEAT: Check Point 4
05/15 12:23:25 [1808] <IndexHeartbeatProc>===Get Index STAGE===
05/15 12:23:25 [1808] ************CSN=9075
05/15 12:23:25 [1808] <mfn_MakeGetIndexUrl:>Request is: action=12&hostid=6697610E0A0A0196019845FB2578159E&chk=CD544A4761BA1844109D0733BA6CAAAF&ck=4CBB72D56540CF3A0BFAA686AB14E412&uchk=E1E339E068CE2A0E4BE845A099B600F2&uck=62B981B45C7B254DB1CEB9A028389467&hid=45E8BCABC22C54DB8324BE2A759704D0&groupid=6D0CD5DF0A0A0196009787E1C8384729&mode=0&hbt=14400&as=9075&cn=[hex]454C443337313932&lun=[hex]5832313430323835&udn=[hex]454C444552534C494D495445442E434F4D2E4155
05/15 12:23:25 [1808] <GetIndexFileRequest:>http://ADLUTIL02:8014/secars/secars.dll?h=4813F81E2DECAEEE82F1B2FCE1E66D64406001EA0167F0B57CAF868624FFA4BAE0F0AAA4BFF7F3202A7059844AB827A2C69D1AF1D6FDC8289076E9044F64149E168592E7048D2F9EFC8C58331D5A530294DA353950E584EB46C4EF7C4F6DE8F80F53F3D793585D88C5F685AFAEFAC4553CDC449A40CC015B784071ADFF39FCBC0C0755FB42445BC3DB53323B70C4398B3279865530829057B390AB10F210D5932C11DBCE3AD5A5D2868A7E587945CF0D93C10E7F0C01B75888850E56299B502EE0347B5AC040286298FC974961484ADC682873CC972050268EE67CA31E8211D4CE565EE656335444430479BFF6576D7D0DFA2018B9D760EE7D7329C9251F39CA00430F5EB17AE41F5D9E820664F521A863AA3A3B6BD7E272C4230D1B71C063202B945C804042BF0F580FEAB59F82D4554540591B6DE0D18203FC1B845A0BC4A58B11D73526FF6B762FE90D7ABD1976C151127D4BAFCA2FAB4772948F546E562CA3687046245BC8609399C226776E116C7580E87920AB7BED83C7292E297DA6FDAE6CAA27F49D8F87209E3448C2BA4FACC4DE5A99C4B857B4CCE3A6EAFE854DA0
05/15 12:23:25 [1808] <GetIndexFileRequest:>SMS return=200
05/15 12:23:25 [1808] <ParseHTTPStatusCode:>200=>200 OK
05/15 12:23:25 [1808] <FindHeader>Sem-HashKey:=>CD544A4761BA1844109D0733BA6CAAAF
05/15 12:23:25 [1808] <GetIndexFileRequest:>Loading the current mode:1
05/15 12:23:25 [1808] <FindHeader>Sem-LANSensor:=>0
05/15 12:23:25 [1808] <FindHeader>Sem-Signatue:=>05421E59CE6AA6DDE23966932BA133362E1C5096CFB01B5CE87C8116A1119D07DDE0CE3B9992ECC67D64F908DC9BD799F2C66BFBF23CCA156604217663B386ACEC52D4D09D2257E1324949FF56FF2B7D2AFA3333A0686FCC758DC5FB19B880DB44FFD162A5CF9FF4AA229712131A8E029898E47EECC4BF32B063B24E2B49F8C6
05/15 12:23:25 [1808] <mfn_DoGetIndexFile200>Content Lenght => 1297
05/15 12:23:25 [1808] SignIf::VerifySignature(data, dataLen, sig, sigLen) => Verification Successful..
05/15 12:23:25 [1808] <mfn_DoGetIndexFile200>Index File: <?xml version="1.0" encoding="UTF-8" ?><GroupIndex SiteID="90E5FE8E0A0A0196004BDA03C4FB3F0A" ServerID="27A8B4F60A0A01960008D503613AFE0F" GroupID="C1BFD0C50A3C1239013944248DB715E6" GroupCheckSum="842CEA790A323210858413531" LastModifiedTime = "15/05/2013 08:33:35">    <Profile Checksum="9CE348E64CEC0BAE9326F098F4D41557" SerialNumber="C1BF-04/03/2013 13:43:38 041" LastModifiedTime="10/05/2013  15:02:52"/>    <ConfigFile Checksum="928C56973774CEFCB8A1815689DDFCF4" LastModifiedTime="10/05/2013  15:02:52"/>    <IDSFile Checksum="8D937E9F1FFE34C1564A124A523A3A52" LastModifiedTime="10/05/2013  15:02:52"/>    <SylinkFile Checksum="6010972FB02BCBEFEF5CA5682379DA44" LastModifiedTime="10/05/2013  15:02:52"/>    <LSProfile Checksum="EEA00F2E5704646F3BFC4E99BA697A5F" SerialNumber ="C1BF-04/03/2013 13:43:38 041" LastModifiedTime ="10/05/2013  15:02:52"/>
    <LiveUpdate>
        <File Checksum="C52F6FAAFCFE55F99447E770B94E0775" DeltaFlag="1" FullSize="1277058" LastModifiedTime="1368572571077" Moniker="{42B17E5E-4E9D-4157-88CB-966FB4985928}" Seq="130514001"/>
         <File Checksum="D8C83594BDE68FCAF4CAFF530464FDE0" DeltaFlag="1" FullSize="1255782" LastModifiedTime="1368572558343" Moniker="{D3769926-05B7-4ad1-9DCF-23051EEE78E3}" Seq="130514001"/>
         <File Checksum="4CFB379BB4860A1B8A01567990821C16" DeltaFlag="1" FullSize="233950864" LastModifiedTime="1368557770968" Moniker="{C60DC234-65F9-4674-94AE-62158EFCA433}" Seq="130514004"/>
         <File Checksum="0C0025B68F404A487B15CE1A93FE38ED" DeltaFlag="1" FullSize="235787925" LastModifiedTime="1368557357874" Moniker="{1CD85198-26C6-4bac-8C72-5D34B025DE35}" Seq="130514004"/>
         <File Checksum="7B4B02503A398120786F2EF07DF57695" DeltaFlag="1" FullSize="669829" LastModifiedTime="1222741814761" Moniker="{C25CEA47-63E5-447b-8D95-C79CAE13FF79}" Seq="80929016"/>
         <File Checksum="78F82DFE2C1DAE2C97B47671EBBCFE99" DeltaFlag="1" FullSize="88188" LastModifiedTime="1223496824146" Moniker="{EA960B33-2196-4d53-8AC4-D5043A5B6F9B}" Seq="80820001"/>
         <File Checksum="5E9FF02A2A16846D2E6BB6275C47DBCC" DeltaFlag="1" FullSize="1662247" LastModifiedTime="1223496827756" Moniker="{DB206823-FFD2-440a-9B89-CCFD45F3F1CD}" Seq="80820001"/>
         <File Checksum="B25C7E668DB326E4388AC46FBAF3A4E1" DeltaFlag="1" FullSize="1419193" LastModifiedTime="1223496851319" Moniker="{C13726A9-8DF7-4583-9B39-105B7EBD55E2}" Seq="80820001"/>
         <File Checksum="72DFE5E82258B0ADAFE72C8A89B4073A" DeltaFlag="1" FullSize="886158" LastModifiedTime="1354200091901" Moniker="{ECCC5006-EF61-4c99-829A-417B6C6AD963}" Seq="2012111400"/>
         <File Checksum="C98B41DDA68208D39A22CEBBFAEDB4A2" DeltaFlag="1" FullSize="77357" LastModifiedTime="1366303288349" Moniker="{CC40C428-1830-44ef-B8B2-920A0B761793}" Seq="130418003"/>
         <File Checksum="E6C95988A79852680D5616C64A41C00E" DeltaFlag="1" FullSize="12713824" LastModifiedTime="1366303293974" Moniker="{812CD25E-1049-4086-9DDD-A4FAE649FBDF}" Seq="130418003"/>
         <File Checksum="D118468BC08975DA64851AEF6832352F" DeltaFlag="1" FullSize="12713857" LastModifiedTime="1366303374411" Moniker="{E1A6B4FF-6873-4200-B6F6-04C13BF38CF3}" Seq="130418003"/>
         <File Checksum="1965AAF98F532C9DD924FE2E9461285C" DeltaFlag="1" FullSize="77345" LastModifiedTime="1366303379693" Moniker="{E5A3EBEE-D580-421e-86DF-54C0B3739522}" Seq="130418003"/>
    </LiveUpdate>
</GroupIndex>
05/15 12:23:25 [1808] <mfn_DoGetIndexFile200>Parser Index File!
05/15 12:23:25 [1808] <GetIndexFileRequest:>RECEIVE STAGE COMPLETED
05/15 12:23:25 [1808] <GetIndexFileRequest:>COMPLETED
05/15 12:23:25 [1808] <IndexHeartbeatProc>GetIndexFile handling status: 0
05/15 12:23:25 [1808] <IndexHeartbeatProc>Switch Server flag=0
05/15 12:23:25 [1808] HEARTBEAT: Check Point 5.1
05/15 12:23:25 [1808] <IsInClientIPorOnLink> NextHop Not equal 10.10.1.150,return FALSE
05/15 12:23:25 [1808] <IsInClientIPorOnLink> NextHop is OnLink with 10.20.137.54,return TRUE
05/15 12:23:25 [1808] <mfn_GetOutIP> Next Hop IP is a local IP or ONLINK:10.20.137.54
05/15 12:23:25 [1808] <IndexHeartbeatProc> Saved IP Address: 10.10.1.150
05/15 12:23:25 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:25 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/15 12:23:25 [1808] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {42B17E5E-4E9D-4157-88CB-966FB4985928} Seq:130514001
05/15 12:23:25 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:25 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/15 12:23:25 [1808] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {D3769926-05B7-4ad1-9DCF-23051EEE78E3} Seq:130514001
05/15 12:23:25 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=0
05/15 12:23:26 [1808] <mfn_LiveUpdate:> Agent returned closest matching seq: 130418005
05/15 12:23:26 [1808] <Add2LUFileList:>Adding LU Info to LU Download File List: {C60DC234-65F9-4674-94AE-62158EFCA433}130514004
05/15 12:23:26 [1808] <Add2LUFileList:>File Info already exists, hence updating: {C60DC234-65F9-4674-94AE-62158EFCA433}130514004
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/15 12:23:26 [1808] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {1CD85198-26C6-4bac-8C72-5D34B025DE35} Seq:130514004
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/15 12:23:26 [1808] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {C25CEA47-63E5-447b-8D95-C79CAE13FF79} Seq:80929016
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/15 12:23:26 [1808] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {EA960B33-2196-4d53-8AC4-D5043A5B6F9B} Seq:80820001
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/15 12:23:26 [1808] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {DB206823-FFD2-440a-9B89-CCFD45F3F1CD} Seq:80820001
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/15 12:23:26 [1808] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {C13726A9-8DF7-4583-9B39-105B7EBD55E2} Seq:80820001
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=20
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/15 12:23:26 [1808] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {CC40C428-1830-44ef-B8B2-920A0B761793} Seq:130418003
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/15 12:23:26 [1808] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {812CD25E-1049-4086-9DDD-A4FAE649FBDF} Seq:130418003
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/15 12:23:26 [1808] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {E1A6B4FF-6873-4200-B6F6-04C13BF38CF3} Seq:130418003
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_LU_REQUIRE_STATUS
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_LU_REQUIRE_STATUS, return=1
05/15 12:23:26 [1808] <mfn_LiveUpdate> EVENT_LU_REQUIRE_STATUS returned ERROR_SYSTEM_UNKNOWN - Ignore LU content. Moniker: {E5A3EBEE-D580-421e-86DF-54C0B3739522} Seq:130418003
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_SERVER_ONLINE
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_SERVER_ONLINE, return=0
05/15 12:23:26 [1808] <ScheduleNextUpdate>Reset Heartbeat factor index, hearbeat=14400 seconds
05/15 12:23:26 [1808] HEARTBEAT: Check Point 6
05/15 12:23:26 [1808] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: AVMan
05/15 12:23:26 [1808] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: GUP
05/15 12:23:26 [1808] <mfn_PostAgentInfo>===REQUESTING PLUG-IN OP-STATE: LUMan
05/15 12:23:26 [1808] <mfn_PostAgentInfo>===REQUESTING CMC OP-STATE ===
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_SERVER_REQUIRES_CLIENT_SESTATE
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_SERVER_REQUIRES_CLIENT_SESTATE, return=0
05/15 12:23:26 [1808] ReasonDescForFailure*** = Host Integrity check is disabled.
05/15 12:23:26 [1808] ReasonDescForFailure*** = Host Integrity check is disabled.
05/15 12:23:26 [1808] *** = <SSAInfo NameSpace="rpc" AgentID="6697610E0A0A0196019845FB2578159E" ComputerID="6D6554940A0A0196019845FB066D6F3A" HardwareKey="45E8BCABC22C54DB8324BE2A759704D0" GroupID="C1BFD0C50A3C1239013944248DB715E6">
<AgentHIInfo Status="3" ReasonCode="105" ReasonDescForFailure="Host Integrity check is disabled."/>
<SSAHostInfo>
<NetworkIdentity UserDomain="ELDERSLIMITED.COM.AU" LogonUser="X2140285" HostDomain="elderslimited.com.au" HostName="ELD37192" HostDesc=""/>
<SSAProduct Version="11.0.6000.550"/>
<SSAOS Version="5.1.2600" Desc="Windows XP Professional " Type="17105154" ServicePack="Service Pack 3" Language="9"/>
<Processor ProcessorType="x86 Family 6 Model 15 Stepping 13" ProcessorClock="1595" ProcessorNum="2"/>
<Memory Size="2099486720"/>
<Disk Letter="C:\" Size="80023715840"/>
<BIOS Version="HPQOEM - 20070718"/>
<TpmDevice Id="0"/>
<SSAProfile Version="5.0.0" SerialNumber="C1BF-04/03/2013 13:43:38 041"/>
<SSAIDS Version="" SerialNumber=""/>
<SSAUTC Bias="-600"/>
<DNSs><DNS Address="10.10.1.4"/><DNS Address="10.10.1.235"/></DNSs>
<DHCPServer Address="10.20.137.1"/><SSANICs><SSANIC Ip="10.20.137.54" Mac="00-22-64-b2-c5-ca" Gateway="10.20.137.1" SubnetMask="255.255.255.0"/></SSANICs><Firewall OnOff="0" Installed="0"/>
</SSAHostInfo>
<RebootRequired Status="0"></RebootRequired>
<InstalledFeatures><Feature Id ="256"/></InstalledFeatures>
</SSAInfo>

05/15 12:23:26 [1808] <mfn_PostAgentInfo>Volatile op-state damper: 0, Interval passed: 1368584606
05/15 12:23:26 [1808] <mfn_PostAgentInfo>Free memory difference: 1416249344, Threshold: 0
05/15 12:23:26 [1808] <mfn_PostAgentInfo>Free disk space difference: 54587117568, Threshold: 0
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_SYLINK_QUERY_COMMANDSTATUS
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_SYLINK_QUERY_COMMANDSTATUS, return=0
05/15 12:23:26 [1808] <mfn_PostAgentInfo><?xml version='1.0' encoding='UTF-8' ?>
<SESAgentOpState AgentID="6697610E0A0A0196019845FB2578159E" Timestamp="1368584606346"><TechID Name="AVMan"><Data><![CDATA[<avstate version="1.0"><RTVScanRunning>1</RTVScanRunning><PatternFileRevision>24</PatternFileRevision><UsingPattern>4006936</UsingPattern><PatternFileSequence>0</PatternFileSequence><PatternFileDate>2B0312000000</PatternFileDate><TimeOfLastVirus>000000000000</TimeOfLastVirus><TimeOfLastScan>280916041A03</TimeOfLastScan><WorstInfectionType>9999</WorstInfectionType><OnOff>1</OnOff><SymProtectOnOff>1</SymProtectOnOff><SymSentryInstalled>0</SymSentryInstalled><SavProductVersion>27466684</SavProductVersion><Licensed>0</Licensed><LicenseStatus>0</LicenseStatus><LicenseExpirationTime>000000000000</LicenseExpirationTime><DecAbiVer>1.2.8</DecAbiVer><EraserEngineVer>7340034:13</EraserEngineVer></avstate>]]></Data></TechID><TechID Name="GUP"><Data><![CDATA[<?xml version='1.0' encoding='UTF-8' ?>
<GupStatus IsGup="0" NameSpace="rpc" ComputerID="6D6554940A0A0196019845FB066D6F3A"/>]]></Data></TechID><TechID Name="LUMan"><Data><![CDATA[<lustate><lastUpdateTime>0</lastUpdateTime></lustate>]]></Data></TechID><TechID Name="SEP"><Data><![CDATA[<SSAInfo NameSpace="rpc" AgentID="6697610E0A0A0196019845FB2578159E" ComputerID="6D6554940A0A0196019845FB066D6F3A" HardwareKey="45E8BCABC22C54DB8324BE2A759704D0" GroupID="C1BFD0C50A3C1239013944248DB715E6">
<AgentHIInfo Status="3" ReasonCode="105" ReasonDescForFailure="Host Integrity check is disabled."/>
<SSAHostInfo>
<NetworkIdentity UserDomain="ELDERSLIMITED.COM.AU" LogonUser="X2140285" HostDomain="elderslimited.com.au" HostName="ELD37192" HostDesc=""/>
<SSAProduct Version="11.0.6000.550"/>
<SSAOS Version="5.1.2600" Desc="Windows XP Professional " Type="17105154" ServicePack="Service Pack 3" Language="9"/>
<Processor ProcessorType="x86 Family 6 Model 15 Stepping 13" ProcessorClock="1595" ProcessorNum="2"/>
<Memory Size="2099486720"/>
<Disk Letter="C:\" Size="80023715840"/>
<BIOS Version="HPQOEM - 20070718"/>
<TpmDevice Id="0"/>
<SSAProfile Version="5.0.0" SerialNumber="C1BF-04/03/2013 13:43:38 041"/>
<SSAIDS Version="" SerialNumber=""/>
<SSAUTC Bias="-600"/>
<DNSs><DNS Address="10.10.1.4"/><DNS Address="10.10.1.235"/></DNSs>
<DHCPServer Address="10.20.137.1"/><SSANICs><SSANIC Ip="10.20.137.54" Mac="00-22-64-b2-c5-ca" Gateway="10.20.137.1" SubnetMask="255.255.255.0"/></SSANICs><Firewall OnOff="0" Installed="0"/>
</SSAHostInfo>
<RebootRequired Status="0"></RebootRequired>
<InstalledFeatures><Feature Id ="256"/></InstalledFeatures>
</SSAInfo>
]]></Data></TechID><TechID Name="SEP"><Data><![CDATA[<SSAInfo NameSpace="rpc" AgentID="6697610E0A0A0196019845FB2578159E" ComputerID="6D6554940A0A0196019845FB066D6F3A" HardwareKey="45E8BCABC22C54DB8324BE2A759704D0" GroupID="C1BFD0C50A3C1239013944248DB715E6">
<SSAHostInfo>
<Memory Free="1416249344"/>
<Disk Letter="C:\" Free="54587117568"/>
</SSAHostInfo>
</SSAInfo>
]]></Data></TechID></SESAgentOpState>
05/15 12:23:26 [1808] ************CSN=9076
05/15 12:23:26 [1808] <mfn_MakePostUrl:>Request is: action=192&hostid=6697610E0A0A0196019845FB2578159E&chk=CD544A4761BA1844109D0733BA6CAAAF&ck=4CBB72D56540CF3A0BFAA686AB14E412&uchk=E1E339E068CE2A0E4BE845A099B600F2&uck=62B981B45C7B254DB1CEB9A028389467&as=9076&cn=[hex]454C443337313932&lun=[hex]5832313430323835&udn=[hex]454C444552534C494D495445442E434F4D2E4155
05/15 12:23:26 [1808] <mfn_PostAgentInfo>http://ADLUTIL02:8014/secars/secars.dll?h=10EAA48152874932EC85676FB74F092FDC967AAA32B22373A0A3B38BFD902AFEEAC125A9D89ACE870F1E60AC26B48747888487DFB127400894EF25BB1220BA13D60B9C120E297E0688C26D7A1A28D621897B4C0424AE7A379A3DC91EEB9CF65BF67F03B7A4DA8786163F1E47B25182CB2E03B27B504E591C1293652DCEAA1AE31C64C9F0813803048C04B5F2B179E61EA00A0564324DE00DFDB6646C03052603028482A3C7B8658D3364652360EB22286E4C1A251A7309F32FECCFB2E4F18BCD945BFF3D2136795575BDCED5AF1FADC273327635315BFE3FE1DCF06D1EFE4593F7DF28DA57077DA92CDD24C25DE96B1479FE0CDC2C8DC0258A55929C73235C3B633FAB18FF6E4759A89B1FD1314061556FC480D1E1398CE24114BD3661D7944FFF46DC0028471D37823875965F4804DC0391992DD436A1AEAE38B46E21E40852
05/15 12:23:26 [1808] <mfn_PostAgentInfo>POST the total size=1284
05/15 12:23:26 [1808] <mfn_PostAgentInfo>Done with return code = 200
05/15 12:23:26 [1808] <IndexHeartbeatProc>===UPLOAD STAGE===
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_SERVER_READY_TO_UPLOAD_EVENT_LOG
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_SERVER_READY_TO_UPLOAD_EVENT_LOG, return=0
05/15 12:23:26 [1808] <IndexHeartbeatProc>===PREPARE EVENT LOG STAGE===
05/15 12:23:26 [1808] <PrepareEventLog>initialized technology extension processing ok
05/15 12:23:26 [1808] <PrepareEventLog>Allow total logs to send=0
05/15 12:23:26 [1808] <IndexHeartbeatProc>Communication Mode=1(Pull mode)
05/15 12:23:26 [1808] HEARTBEAT: Check Point 8
05/15 12:23:26 [1808] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
05/15 12:23:26 [1808] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
05/15 12:23:26 [1808] <IndexHeartbeatProc>====== IndexHeartbeat Procedure stops at 12:23:26 ======
05/15 12:23:26 [1808] <IndexHeartbeatProc>Set Heartbeat Result= 2
05/15 12:23:26 [1808] <IndexHeartbeatProc>Sylink Comm.Flags: 'Connection Failed' = 0, 'Using Backup Sylink' = 0, 'Using Location Config' = 0
05/15 12:23:26 [1808] Use new configuration
05/15 12:23:26 [1808] HEARTBEAT: Check Point Complete
05/15 12:23:26 [1808] <IndexHeartbeatProc>Done, Heartbeat=14400seconds
05/15 12:23:26 [1808] </CSyLink::IndexHeartbeatProc()>
05/15 12:23:26 [1808] <CheckHeartbeatTimer>====== Heartbeat loop stops at 12:23:26 ======

Please advise
 

Some article related to "Proxy error 87" which are availble in your sylink log

SEP client is not able to communicate with SEPM

Symantec Endpoint Protection (SEP) client cannot connect to Symantec Endpoint Protection Manager (SEPM), Error: Unable to create Session with 'No Proxies' settings - Error Code: 87

Clients stop to communicate with SEPM

hello,

Try to this

05/15 12:23:16 [3744] <Start>Unable to create Session with 'User Proxy' settings - Proxy Server: Error Code: 87
05/15 12:23:16 [3744] <Start>Unable to create Session with 'No Proxies' settings - Error Code: 87

SEP client is not able to communicate with SEPM

Usage of Proxy Settings in SEP 11.x Client Communication

https://www-secure.symantec.com/connect/articles/usage-proxy-settings-sep-11x-client-communication

Hi,

With reference to following article have you checkd the connectivity by doing reboot of the machine.

https://www-secure.symantec.com/connect/articles/usage-proxy-settings-sep-11x-client-communication

When SEP first starts, it attempts to connect to SEPM without using a proxy. Regardless of the proxy setting the client always attempt to connect without a proxy first. If the client is unable to connect to any servers in its management server list, it will rotate its proxy settings at the end of the heartbeat. The next heartbeat will be attempted with proxy settings (if available). Once SEP is able to connect, it will not change its proxy settings until it is restarted. You could say it ‘locks’ the setting once it connects. This means that if the client connects without proxy, it will never connect via the proxy until it is restarted. If the client connects though the proxy, it will never connect directly to SEPM until it is restarted. Whichever one works first, that is the one the client will always use

Error code 87 indicates it's a proxy related issue, have you done any change in network proxy?