Endpoint Protection

Good morning all,

I'm hoping that coming here will help me try and troubleshoot and resolve these issues. I've been appointed to troubleshoot some of the server issues we're experiencing with Symantec Endpoint Protection Manager 12.1.4. All of our Symantec information was stored on a separate drive with 40gb of space available. We would continuously get error messages regarding disk space, but by the time I would look there would be some space available and I wasn't able to find the culprit. Today that has changed.

Our three biggest directories are: data (12.5gb), db (6.47gb), and inetpub (14.7gb).

I've spent the entire morning researching what could be causing this issue. I don't believe this is a revision retention issue as going through the two folders there were only three options. I went to check the conf.properties file however that was blank, and lead me into other issues. The other issue that I looked up was sep5.log? sem? Not sure, but that didn't appear to be the case anyways... 

Following the instructions, I deleted the two older revisions for 32bit and 64bit. That gave me about 3gb, but then that quickly filled right back up. 

The reason why I'm including the SEPM issues is because if any resolutions involve going into the SEPM panel, I won't be able to. Everytime I run the management console the SEPM service shuts down. Unsure if this is the space issue or not. I mentioned conf.properties being blank. I am experiencing this issue directly:

http://www.symantec.com/business/support/index?page=content&id=TECH179741

I ran the fix however that did not resolve the issue. As I'm new to running this server I may not be able to answer everything quickly, but I'll be more than happy to get you all of the information that you need.

Thanks for your help!

How many content revisions are you keeping? Inetpub is where this content is stored.

How many total clients?

Please have a look thru thess articles:

Disk space management for Endpoint Protection Manager

Managing log data in the Symantec Endpoint Protection Manager (SEPM)

For the content revisions, here is where I'm not sure. conf.properties was blank, and I believe it said the default was 10. While there are a bunch of folders (all with little space in them), the only folders I read that were important were 535CB6A4 and 07B590B3. Both of those folders had a lot of space in them, and each had 3 folders. These were the two folders where I deleted the older 2 and left the most recent, but they repopulated.

Brian, I did check that link and unfortunately due to the SEPM issues I am unable to verify the settings listed there. Trust me I tried! :)

Sorry, didn't reply directly. Please check thread as I responded. Will make sure this doesn't happen again!

It filled up because it's controlled via the SEPM, it's not recommended to remove those manually.

The DB size depends on how many clients you have, logs you're keeping etc. Do you have the embedded or SQL db?

You may want to consider upgrading to 12.1.5 as it has anew feature for disk management and shrinks down the content size significantly.

Have you contacted support?

While we do have a SQL server here, I believe that the antivirus was using embedded since we were only using one server. 

I have not contacted Support. I was trying to see what responses I could get here to steer me in the right direction before hand. I didn't want to post and contact support at the same time either, but if that's the best recommendation then I can do that.

Do you have direct access to the SEPM so you can see settings?

I do not have access to SEPM. The SEPM service keeps shutting down so I get failure to connect when attempting to open the console.

As per this link: http://www.symantec.com/business/support/index?page=content&id=TECH179741

That is exactly what I experience, try to fix, and it didn't resolve it.

If you could have someone enable FINEST debugging and post the scm-server0 log that would help to troubleshoot the root cause

How to debug the Symantec Endpoint Protection Manager

I see that there are 2 backups in the SEPM\Data\Backup folder. Can I delete the one from 11/23 to give me back about 5gb to see if the SEPM service will start?

How can I enable FINEST logging if SEPM Console isn't working and I can't access it?

Whomever does have access will need to do this.

Yes, you can delete.

Brian, 

I'm not sure if you're misinterpreting me or I'm misinterpreting you. I have physical access to the console and the server. The SEPM console isn't working and is experiencing issues in the link I linked above. How would I enable FINEST debugging if the console isn't working?

is the space 0 ? service might have stopped for a different reason post the scm-server0.log it will be under

:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\logs\

The console doesn't need to work in order to enable debugging. You just need to edit the conf.properties file

Here is the scm-server0.log file. Unfortunately it hasn't updated passed 10:39am. We do have 10gb available now on that drive, but are still having issues with the SEPM service shutting down.

Attachment(s)

scm-server-0_44.zip   6 KB 1 version

try this 

http://www.symantec.com/business/support/index?page=content&id=TECH225967

by the way from the log Your SEPM is on E drive, you should have enough space on C drive too...thats where all the temp files get generated coz of being the OS drive

Rafeeq, we do have 7gb available on the C drive. We also have 10gb available on E drive however we still aren't able to get SEPM to work as something keeps shutting down the service.

Also, this is RU4 not 5.

To be honest, drive space is low but what you have should be enough for the SEPM to function just fine. Again, we may need to dig into the scm-server-0.log file to see the cause.

I'm going to close this ticket. While I did contact Support (the 2nd round did NOT go well!!!), we wound up having to run Cleanwipe, installing 12.1.5 SEPM, and then restoring / upgrading the database from the latest backup from Symantec. Support stated that our database had become corrupted, and doing a cleanwipe was probably the best means of just starting fresh.

Right now the big issue that I'm having is trying to figure out how to upgrade to 12.1.5 client so that I can start working on remotely pushing it out. I've been looking for the right article to help me out here but haven't been able to find anything. I'll create a new ticket for that if need be.

Thanks for your help everyone!