Endpoint Protection

Hi Team, I have a SEP 12 client which is online and upto date when I am checking manually. However, when I am chiecking it on SEPM 14 console, it is online but showing outdated definition.

Download and run the SymDiag tool on the affected client for additional error checking. Also, enable sylink logging and let it run through a few heartbeats:

http://www.symantec.com/docs/TECH104758

What is the exact version of the client and SEPM?

Hi Brian,

The Client is SEP 12.1.MP5 and SEPM is 14 MP2,

Further we have also opened case with Symantec and provided them the above logs but they did't find anything.

We also provided logs from SEPM and the finding was:-

Issues Found:

• There are a large number of deadlock events mentioned. To resolve this, we will want to stop SEPM services on all SEPMs in the site, and then start them again (not one by one, but all at the same time).

Caused by: com.microsoft.sqlserver.jdbc.SQLServerException: Transaction (Process ID 55) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction.

• The data *is* getting processed by the SEPM, but it is going *really* slowly.

Recommendations:

1. Stop the SEPM services on all SEPMs in this site
2. Go into the %SEPM%\Data\Inbox\ folder for each SEPM, and search for *.dat files. These can all be deleted (clients are uploading new .dat files constantly).
3. Restart the SEPM services 

Requeted to please share your comments if any.

Hi Team,

Just to update that below troubleshooting steps resolved the issue.

1. Stop the SEPM services on all SEPMs in this site
2. Go into the %SEPM%\Data\Inbox\ folder for each SEPM, and search for *.dat files. These can all be deleted (clients are uploading new .dat files constantly).
3. Restart the SEPM services