Endpoint Protection

Hi Folks,

Just wondering if anyone has any thoughts on this issue.  I recently upgraded SEPM at one of my sites from 12.1.4112.4156 to 12.1.5337.5000.  This is a VMware VM, Server 2008 R2 64-bit (running IE 11, just in case it's relevant), using the Embedded database.

All appeared to go perfectly with no obvious issues, but some time since this upgrade something has gone screwy with the Security Status View Details screen.

It shows Attention Needed, which is not uncommon and usually means I have some clients that have missed being scanned recently.  But when clicking on the link, instead of getting the stats for the various categories, I get the following on the Summary Tab:

QUERY FAILED

This query could not be processed for one of the following reasons:

1. The database query timed out. Try reducing the number of filters, or increasing the SQL Server query timeout value.
2. An unexpected error occurred. Try running the query again by using default filter values.
3. String encoding was possibly not UTF-8, and may result from copying and pasting data instead of typing data. Try typing data in the input fields.

All the other tabs (ie: Logs, Command Status, Notifications & Security Virtual Appliance) look fine.  If I click back onto the Summary tab, it shows the pie charts for Risk Distribution, etc.

I've done a bit of research and come up with a few links, but they mostly seem related to SEP 11 with FastCGI, or an environment that is using an external MS-SQL database (I'm using the Embedded database).

I've attached an extract from reporting.log (as reporting.log.txt), which looks to show issues whenever I try this (note: the timezone warning messages have been there well before this upgrade).  I can see there is an issue, but not sure where to go from here.  I've also attached the Upgrade-0.log, but can't spot anything obvious there.

As part of looking at this, I've started and stoppped services, rebooted the server, run the Upgrade.bat again, and tried Repair several times.  Something interesting, and an unwanted side-effect of running Repair a couple of times:

Control Panel was showing the SEPM installation was about 2.4GB.  After each run of Repair, this value has doubled, so currently says the install of SEP is 6.5GB.  I think this is totally unrelated, but I wouldn't mind some guidance on where this extra space has gone.  No doubt it is a backup taken during the Repair, but so far I haven't been able to spot where it is.

Many Thanks,
Steve

Any errors showing in Admin >> Server tab in SEPM?

Hi .Brian,

I've had a look there.  Earlier on while I was doing the Repair(s)/Upgrade.bat there was one occurrence of "Unexpected server error", but nothing else.

I've tried generating the same issue again, and there was nothing new logged in the Admin>>Server tab.

 

Can you also set SEPM debugging log to FINEST and let it run. Then post the scm-server-0 log file http://www.symantec.com/docs/TECH102413

Hi .Brian,

Here you go.  I set up debugging then started the SEPM console, logged in, did a couple of refreshes, and then accessed (twice) the Security Status page that generates the error.

I'm leaving the office shortly so will check back in again tomorrow if you don't find anything before I go.

Many Thanks, Steve

I am running into a similar issue after performing the same upgrade.  I am getting the error on the logs while trying to run a report on the Device Control Logs.

There is only a filter for the past 24 hours of logs.

This query could not be processed for one of the following reasons:

1. The database query timed out. Try reducing the number of filters, or increasing the SQL Server query timeout value.

2. An unexpected error occurred. Try running the query again by using default filter values.

3. String encoding was possibly not UTF-8, and may result from copying and pasting data instead of typing data. Try typing data in the input fields.

Also,  My Summary Pages under monitors are all showing No Information 

Hi RokaIT,

I checked my environment against your issues just in case I had some of those as well:

• Device Control Log - No issues, report is fine
• Filters - No Issues, all filters available
• Summary Pages - most have empty charts, but that is expected as there is no data for those items.  Site Status and Top Error Generators By Client do show data.

So my issue only relates to the Security Status.  Hopefully someone will come up with something useful soon, if not it will be off to Support.

Steve

Hi,

I have the same issue here. I have updated from 12.1.3 to 12.1.5 (12.1.53337.5000) - the server is a Windows 2003 x32 Standard Edition (localized German, latest patchlevel beside those from the last patchday) virtualized on vmWare.

Always when I log onto the server via RDP and open the SEPM-console there I first get the Error on the 'Summary'-tab when clicking on the 'View Details'-link from the 'Security Status'-section.

 

But when I activate an other tab and then go back to the summary-tab it often (only in the RDP-Sessions) opens with nearly no content (which does not help to identfy the "problems" that will result in the red status):

Regards

Hi, I have exact the same issue here with a 2008R2 Server, also virtualized on VMWare with embedded Database.

I have also a second Location with a real 2008R2 and there it works like expected.

 

Best Regards

Andreas

same issue here at a customer site:

 

migration from 12.1.4a to 12.1.5  embedded DB

 

already tried on different admin-users with different settings for filters..

 

This query could not be processed for one of the following reasons:

1. The database query timed out. Try reducing the number of filters, or increasing the SQL Server query timeout value.

2. An unexpected error occurred. Try running the query again by using default filter values.

3. String encoding was possibly not UTF-8, and may result from copying and pasting data instead of typing data. Try typing data in the input fields.

 

 

 

Same issue here. Obviously a bug.

Same issue here as well. Login to SEPM: Security Status - Attention Needed

I have run db upgrade and repair several times as well (my installation is 16.4GB in the meanwhile), tried different Admin profiles and no luck so far.

The worst thing is, I only upgraded from 12.1.4 to 12.1.5 due to another bug we experienced occasionally on two file servers, which according to the release notes should have been fixed with 12.1.4 already!

 

Have the same issue upgrading from 12.1.4 to 12.1.5 on virtual (HyperV server)

Called Symantec, they have no idea what is going on. The issue was escalated to developers and I was told it will be fixed in the next release but there is no ETA on it.

Looks like this is a standard answer just to get you off the phone.

Did they collect any logs or troubleshoot further? What OS?

here what tech i was on the phone did:

1) run  SEP repair

2) run DB upgrade

3) increased timeout in PHP  file to 600

4) he upload a new "include-sqlfilter.php" and replaced the original

nothing helped

Then he asked me to upload DB to symantec wich i did but he can not see it. However when i try to upload itagain, i get a message that says the file already there

 

This is HyperV guest server Windows 2008 standard

 

Can someone try the document mentioned in the discussion and update this thread?

https://www-secure.symantec.com/connect/forums/sep-1215-upgrade-unexpected-server-error

May need to turn on FINEST debugging and post he log here for review so it can be checked for relevant errors.

i just wen throught ther Article:TECH163063

wil check on monday

 

how do i turn on FINEST beduging and where do i look for the log file

This article explains it

 How to debug the Symantec Endpoint Protection Manager

the debuggin already was on FINEST

attached is the log files

logg files already uploaded.

look above

Article:TECH163063 did not work

any sugestions?

I've opened a ticket with Symantec Enterprise Support and provided these guys with logs and backups. They determinded the error in my case to be a missing table in the embedded database. Which seems to have gotten lost during the upgrade? Unfortunately I have not been presented with a solution, other  than performing a disaster recovery.

who do i perform desuster recovery?

@rtomchinskiy http://www.symantec.com/docs/TECH163063

 

This wil help to perform a disaster recovery Disaster recovery best practices for Symantec Endpoint Protection 12.1

already followed the article http://www.symantec.com/docs/TECH163063, did not work

i did disaster recovery and everything is coming back to normal. I am not going to upgrade to 12.1.5 RU5 again since it has major bug in there.

Is there an ETA when symantec is going to release RU6? i saw betta virsion is already out there

I ran into this problem today in a customer-environment running RU5 with embedded database. Unfortunately we did the upgrade many weeks ago with no database-backup still present. The data behind the report seems to be there, but the summary view generate the error mentioned above. With all the good changes in RU5 the customer dicided to continue on and hope for a coming remedy from Symantec.

I double checked with another customer that also run RU5 but on SQL database and they don't get these errors.

Both environments are upgraded from RU4 MP1b.

 

Cheers/Jonas

Does it mean that Symantec will not fix the issue with RU5 for users that using embedded DB?

It would be fixed in a later version.

Is there an ETA for the new virsion?

All I've heard is early next year...sorry.

Any Updates on this?

I have the same issue here. After upgrade from 12.1.4 to 12.1.5. On two (primary and secondary-replication) our SEPM servers (embedded database).

The reason you have this problem is the bug in version 12.1.5. During the upgrade new version deletes one of the tables. You can try repair the installation, but it will not help. You have 2 options: first, deal with the problem and wait till version 12.1.6 will be released or uninstall 12.1.5, re-install 12.1.4 and restore private key with the database. I assume you saved setup files and made good backup of DB before upgrading.

I spend a lot of hours on the phone with Symantec as well as online. Finally gave up, uninstalled 12.1.5, re-install 12.1.4, restored DB and private key and everything is normal now.

Symantec confirmed this is a bug?

Yes, Symantec confirmed that it's a bug. Or in other words, they are analyzing it and know about the issues as rtomchinskiy wrote, they know about a table in the embedded database getting lost during the upgrade to 12.1.5. The only workaround so far is to uninstall SEPM and perform a disaster recovery.

I too have this issue after upgrading SEPM to 12.1.5!

I wonder if the upgrade to 12.1.6 (when it is released) will magically fill in the missing table?

....or will the uninstall SEPM/perform disaster recovery proceedure still be required for us 12.1.5 users?

 

The same issue here after upgrade from 12.1.4 to 12.1.5.

Is there any updates on this?

I just had this happen on my Manager and now I have 400+ clients suddenly out of date. I had already updated from 12.1.4 to 12.1.5 for about a month now and had no issues.Anyone have a update on this issue. 

ALL:

I too had this problem.  While applying a solution to a different problem (see: https://www-secure.symantec.com/connect/forums/sep-sbe-1215-install-log-dmp-files-consuming-disk-space#comment-10911411 )

I noticed that the Query Failed problem was also resolved.  Perhaps a Symantec employee can explain if my solution was a fluke or a legitimate fix, but here are the steps I followed from Chetan in the link above, which had the side-effect of fixing the Query Failed issue:

1) Disable Tamper Protection.
2) Open a Command Prompt window.
3) del "C:\ProgramData\Symantec\Symantec Endpoint 
Protection\12.1.5337.5000.105\Data\Install\Logs\*.dmp"
4) Using regedit.exe, set 
HKEY_LOCAL_MACHINE\SOFTWARE(\Wow6432Node)\Symantec\Symantec Endpoint 
Protection\CurrentVersion\Common Client\Debug\CrashHandler\DumpOn* to 0.
5) Re-enable Tamper Protection.
6) Open a Command Prompt window.
7) cd "C:\Program Files (x86)\Symantec\Symantec Endpoint 
Protection\12.1.5337.5000.105\Bin"
8) smc -stop
9) smc -start

I am also having this same issue after upgrading to SEPM 12.1.5 (12.1 RU5).  I am getting the "Security Status - Attention Needed" warning in SEPM and the details indicate "Query Failed".  All of my reports have no information to display at this point.   Seems like this has been an ongoing issue for folks for some time now.  Has anyone been able to find a solution ?   

Thanks -- Jeff

 

 

Jeff,

I spend too much time trying to fix it along and with Symantec. The bottom line, Symantec stated it will be fixed in version 12.1.6.

You can wait till 12.1.6 is released or if you need immediate solution you need to uninstall 12.1.5 and install the latest 12.1.4, then restore private key and DB (hopefully you did full back up before upgrading Symantec).

That is what i did and it works as before the upgrade.

Well, I tried to fix it with Symantec, too. One of their agents provided me with an SQL scripts to create the missing table and it looks like this:

CREATE PROCEDURE SEM_HOMEPAGE_UNMANAGED_DISTINCT_MACHINES(in filter_5150 ntext)
BEGIN
DECLARE Command ntext;

SET Command =  ' SELECT count(DISTINCT MAC_ADDRESS)  as anzahl from (SELECT  DISTINCT L.MAC_ADDRESS, L.IP_ADDRESS, COM.COMPUTER_NAME
                             FROM LAN_DEVICE_DETECTED L with (NOLOCK), SEM_COMPUTER COM with (NOLOCK), SEM_AGENT SA with (NOLOCK)
                             WHERE L.COMPUTER_ID = COM.COMPUTER_ID AND L.DELETED = 0 AND COM.DELETED = 0
                             AND COM.COMPUTER_ID = SA.COMPUTER_ID AND SA.DELETED = 0
                             AND L.MAC_ADDRESS NOT IN (SELECT MAC_ADDR1 FROM SEM_COMPUTER with (NOLOCK) WHERE MAC_ADDR1 IS NOT NULL)
                             AND L.MAC_ADDRESS NOT IN (SELECT MAC_ADDR2 FROM SEM_COMPUTER with (NOLOCK) WHERE MAC_ADDR2 IS NOT NULL)
                             AND L.MAC_ADDRESS NOT IN (SELECT MAC_ADDR3 FROM SEM_COMPUTER with (NOLOCK) WHERE MAC_ADDR3 IS NOT NULL)
                             AND L.MAC_ADDRESS NOT IN (SELECT MAC_ADDR4 FROM SEM_COMPUTER with (NOLOCK) WHERE MAC_ADDR4 IS NOT NULL)
                             AND NOT EXISTS (SELECT *
                 FROM LAN_DEVICE_EXCLUDED E with (NOLOCK)
                             WHERE L.HASH = E.HASH AND E.DELETED = 0
                             AND ( (E.EXCLUDE_MODE = 0 AND E.MAC_ADDRESS = L.MAC_ADDRESS)
                             OR (E.EXCLUDE_MODE = 1 AND E.IP_ADDRESS = L.IP_ADDRESS)
                             OR (E.EXCLUDE_MODE = 2 AND L.IP_ADDRESS >= E.IP_RANGE_START AND L.IP_ADDRESS <= E.IP_RANGE_END)
                             )
                 ) '
|| filter_5150 ||
' )  as UNMANAGED_MACHINES ';
    EXECUTE IMMEDIATE WITH RESULT SET ON Command;

END;;

 

However, it is tailored for a german SEPM (see the line "SET Command", the word "anzahl" means "number of") and worked for me. Attached, please find the steps to take in order to create the table and bear in mind that I will and cannot guarantee that it works for you as well. In any case, make a backup before beginning.

If you don't feel comfortable in performing this procedure, I'd suggest to stick to rtomchinskiy's last post.

 

I encountered the same issue with Query failed and none of my monitoring reports showed any data.  I thought I had the problem fixed when I was able to get the status alert to turn back green.  I tried the management server configuration wizard and accepted all the same values.  Once everthing completed with the wizard and I logged on, I had a green status.  I refreshed the home screen several times and the green status stuck.  However, when I went to the monitoring reports and saw no data, I returned to the home screen and refreshed again.   Once again I have the red security STatus - Attention Needed.  This problem did not show up until today on my one SEPM on a Windows 2003 server.   I did find where there was a windows security update KB3048051 related to untrusted certificate store.  The update was installed by WSUS. 

Did the solution I posted on 23 Feb 2015 not work for those who are posting after my post?

I will try your solution today. how do you disable the tamper protection?

How to disable Tamper Protection in Symantec Endpoint Protection 12.1:

http://www.symantec.com/business/support/index?page=content&id=TECH192023

Newkansan's solution did not work for me.

Has anyone found a solution to this ridiculous issue??

 

i have also same issue

Security status-attention needed  

 

 

This query could not be processed for one of the following reasons:

1. The database query timed out. Try reducing the number of filters, or increasing the SQL Server query timeout value.
2. An unexpected error occurred. Try running the query again by using default filter values.
3. String encoding was possibly not UTF-8, and may result from copying and pasting data instead of typing data. Try typing data in the input fields.

 

 

Any solution????

I have been trying to determine if a newer version has been released.   Either I'm just missing it or Symantec's website has that information buried somewhere.    Does anyone know if there is a version later than 12.1.5 RU5 available that addresses this problem ?  This thread has been going almost 6 months now.   It's pretty shameful that they haven't addressed this issue IMHO

 

I worked with a Symantec tech support on this issue the other day and what i was told was to uninstall and reinstall the manager was the only fix they have for this until 12.1.6 is released which they would not even confirm if that would be soon. Really frustrating especially since that is the only way you can recognize unmanaged machines on your network.

i was told several month ago that the problem will be fixed in 12.1.6. I saw a beta virsion on symantec fileconnect site but now it is not there. I guess the problem exist even in 12.1.6 beta virsion.

i did  what they suggested to you and even run the DB rebuild several times, nothing helped.

i end up rolliong back to 12.1.4 and everythkgn works grate for me since then

I was actually told there was a fix it is just pretty extensive and the tech would need to get back with me but I never heard from him and when I got another tech he said the manager would need to be reinstalled

SEPM 12.1.6 are released

“Query Failed” when switching between log content tables

Fix ID: 3741906

Symptom: “Query Failed” error screen displays when switching between log content tables if the previous table was sorted by a column that is not in the new table.

Solution: Updated sorting column to default to Time if the previous sorting column is not in the new table

https://support.symantec.com/en_US/article.TECH230558.html

12.1.6 just released

Symantec Endpoint Protection 12.1.6 Release Notes

http://www.symantec.com/docs/DOC8626

New fixes in Symantec Endpoint Protection 12.1.6

http://www.symantec.com/docs/TECH230558

Hi,

I'm the one who started this thread, and I can confirm that after applying 12.1.6 this issue is resolved.  I've requested a split solution between Brian and James007.  Brian was first with the info, and James pointed out the specific fix in the Technote.

I'd actually tried installing 12.1.6 before I'd seen these comments.

Now let's see what new issues 12.1.6 throws at us :-D

Thx,

Steve

12.1.6 is released ??

Yes, released on Wednesday

Symantec Endpoint Protection 12.1.6 Release Notes

http://www.symantec.com/docs/DOC8626

New fixes in Symantec Endpoint Protection 12.1.6

http://www.symantec.com/docs/TECH230558

new version download link any??

You can download symantec fileconnect.

https://symantec.flexnetoperations.com/control/symc/registeranonymouslicensetoken

The 12.1.6 is there to download. However before downloading it  i suggest to call Symantec. I just called them to ask a question and Symantec support is not aware of new  version 12.1.6 release.  How can they support it if they do not know about it?

For those who updated  to V 12.1.6, do you need to create and  push new package to every PC or Symantec client can recognize new version and download the client update on its own?

You would need to add the updated package via auto-upgrade.