Endpoint Protection

Hi All

 

I really need a hand on this issue,

I have read through loads of threads and followered a few that looked simalar but nothing has worked.  

 

(What i have done) - I have repaired my installation but cant connect still.  I have ran Management Server Configuration Wizard to no avail.  I have also restarted OS and services again to no avail.

 

When i have looked through the scm-server-0.log i find a strange message about operating systems.  I have posted the log if any can help?

 

If there is anything else just ask cheers in advance

 

Gareth

 

 

Enable advanced logging

How to debug the Symantec Endpoint Protection Manager

What SEPM version and DB type?

Please post scm-server-0.log and catalina.out file logs ?

Log

You're out of disk space, you need to clear it up.

Disk Space Management procedures for the Symantec Endpoint Protection Manager

2014-08-14 02:53:31.383 THREAD 32 SEVERE: Your hard disk space is less than <1,024>MB and impacts the performance of Symantec Endpoint Protection Manager. You should delete some files to free up space. Symantec recommends that you have a minimum of 1GB of free disk space.

How much disk space available in drive ?

I have 10GB of free hard space this is off a few weeks ago

SEPM V 12.1.30001

 

DB is apache i think its just the default 

 

 

 

You need to free up disk space, 1GB, preferably more.

If it's not an up to date log, re-enable logging and post an updated log here for review.

Hi,

Issue has occurred due to low disk space.

Message in the log is very clear "2014-08-14 02:54:09.627 THREAD 32 SEVERE: Your hard disk space is less than <512>MB. Symantec Endpoint Protection Manager requires more disk space to complete certain tasks. Please delete some files to free up some space. Symantec recommends that you have a minimum of 1GB of free disk space."

To make free space follow this article

http://www.symantec.com/docs/TECH96214

Apart form it, you can try the following workarounds as well.

1) Move the recent backup to another location. Default location would be C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\backup - This is a temporary workaround.

2) Delete the older version packages if present any and they are of no use.

SEPM --> Admin --> Install package --> Right click on old package and select delete.

3) Make sure database maintenance is taking place, check the database settings.

 

As per logs it says "Server is not configured correctly, please run Server Configuration Assistant!

Please run management server configuratin wizard.

Chetan Savade

I have ran the management server configuring wizard and it goes through but still stops the service.

 

I have enough space i deleted tmp files weeks ago. I have 10.2GB free space.  The way this was set up in the past the y didnt think about the logs on excec and on this to grow as big as they do i have inherited this in my new job

 

"If it's not an up to date log, re-enable logging and post an updated log here for review." - How do i reneable logging if i cant access the console?  This problem must of accured on the 19/08/14 because that was the last entry!

 

 

Why does symantec keep deleteing my post i will get the info asap

It's not being deleted but for some reason being detected by the backend spam engine. An admin needs to manaully release. This is why you see the red dotted box around your posts.

Reet i have ran management server config util, but still doesnt run the management console.

 

I have freed up space weeks ago i now have 10.2gb so its certainly not that.

How do i enabele advanced logging without being able to get onto teh console?

 

This log was the most recent log it had on the server i will try to find a newer one but i think this is when the problems started without me realising it

 

Cheers

Gareth

 

No Bother thats the 2nd post it has held both had all the info on basically i have tried all that was said

There is 10.2gb Free space 

Can you restart the machine?

Restarted a few tiomes now still no good

 

Symantec will not get removed automatically. Is service available in services.MSc? how many people maintaining this server? , since there is no space. Check other administrators. For to increase the space they might deleted the Symantec folder.

Hi,

Go to the service.msc. Restart the following sertices & let us know which one is in stopped mode

1) Symantec Endpoint Protection Manager Service

2) Symantec Embedded Database Service.

Number 1 mate and no there is only me administratering it 

 

What happens is when i try logging on so the service calls the db thats when it stops.

 

Cheers

 

 Hi,

Attach the latest scm-server-0.log file, old file showing latest timestamp for 19th Aug'14.

can you try the ODBC part as per this document

http://www.symantec.com/business/support/index?page=content&id=TECH104746

is the connection status successful?

Hi Chetan,

 

The scm-server-0.log is the last log SEPM had recorded unless there are other logs this is all i have.

 

Rafeeq the link does not work mate

 

 

Rafeeq i think your on the right track i have managed to open the link in a different browser for some reason chrome and IE didnt like it.

 

When i check the ODBC32.EXE setting and click on DSN i get this error-

Driver Name ia an empty string in data source Symantec Endppoint Security DSN 

 

Then i clcik ok and there isnt anything in the system DSN

 

What should be in there?  Cheers

 

Also DBSRV12.EXE is listening on port 2488 not 2638 i presume this has being confirgured this way at start of install i can go throught the connection wizzard and check if needed

In line with your latest posts, you might find the below article handy:

http://www.symantec.com/docs/TECH157461

Make special note of the location of the ODBC tool used, as the 64bit one doesn't show the same connections as the 32bit version (which is what SEPM uses).  More info can be found in the below article:

http://www.symantec.com/docs/TECH102763

Also going back a few steps, you should have three SEPM services altogether.  The logs you've provided so far only account for the main "Management Server" service, but not the "Web Server" or "Embedded Database" services.

Can you have a look at the logs for these too?

WebServer (Apache) error.log:
http://www.symantec.com/docs/TECH94290

Embedded DB err.log and out.log (Note: these are just provided to help you locate the logs.  Don't run the Solution steps unless the issue applies to you, as they will result in the loss of some data).
http://www.symantec.com/docs/TECH217436
http://www.symantec.com/docs/TECH134782

SMLatCST -  I have looked through these posts and they dont really apply to my problem.  Thanks though.

 

Is there any other logs which will help people locate my problem i am running out of ideas.

 

Cheers

 

 

do a netstat - abo and see who is using what ports

you are on SQL db right?

if on embedded check this registry to see the port number 

http://www.symantec.com/business/support/index?page=content&id=TECH157461

and Yes, on 64 bit OS you need to check the db from 

http://www.symantec.com/business/support/index?page=content&id=TECH102763

I am on server 2008 r2 64 but the application has being installed for 32bit

 

2 mins i will check this and post my findings cheers

 

Also my db is ebedded (apache)

When i check the ODBC32.EXE setting and click on DSN i get this error-

Driver Name ia an empty string in data source Symantec Endppoint Security DSN 

 

 

Could this be my problem there isnt a dsn entry in the odbc32.exe what driver does this use and what should the details be?

Would it not be easier if i were to install it again?  How easy is it to migrate the DB raw so if i just copy it to another location then point the install to it once i have got rid?

 

No copying it will not work... how many clients do you have? I think we are having port conflict here thats why the db is not getting started. default port number for embedded is 2638, check the registry ( i posted the link)

for port, run the management server config wizard, use the port u get from registry, once finished u should be able to log in , if u have few clients. run a fresh install.

use this method to hook your clients to new SEPM

http://www.symantec.com/business/support/index?page=content&id=TECH199124

I have just ran the management server config and now it says that the server port you choose is not used by the databae server.  You must choose the port that the embedded DB server users.

 

Surely this hasnt changed how can i find out which port the embedded db users?

 

No bother i will change the port like it says in the instrauctions then get back to you.  I have over 500 clients 

Right i have followered those instrauctions and have changed the port to 8443  But when i run the mscw it says that the server port you choose is not used by the databae server.  You must choose the port that the embedded DB server users. 

 

Is there anywhere else i need to change the port at?

Can you post a screenie of the MSCW and ports you've chosen?

Also, as I linked earlier, you can change or verify what port the Embedded db is using by following the below article:

http://www.symantec.com/docs/TECH157461

By the by, just to clarify.  8443 is the port usually used by the "Management Server" service (the tomcat component) and not the embedded db.

Therefore, I wanted the screenie so we're all on the same page as to what component is using what ports.

do the netstat - abo, you will know what port used by whom...As I said earlier there is a port conflict 

I have set up team viewer check your mail

Ports

start - run

cmd

netstat -abo >portlist.txt

attach the portlist.txt please

As requested 

team viewer is using 8443.. either stop it or uninstall it.. run the mscw..

TBH, looking at the end of the list, it seems you've now got the SEPM's Embedded DB service listening on 8443 as well as 2638 (unless you have mutple instances of dbsrv12 runnign for some reason, might be worth checking task manager)

I'd personally recommend running through the below article again and switch it back to the default 2638 port:

http://www.symantec.com/docs/TECH157461

Hi Rafeeq i have stop the team viewer service and ran mscw again and now it say port is being used by something else

Hi SM i did ran through that directory and i still got that message thats why i said is there anywhere else that needs changing because it still had the original port somewhere 

did you check the registry to see what port used by embedded db?

Yes it was the original 2638

Soooooo, despite all the areas mentioned in the article being set to use the default 2638 port, you're still seeing instances of dbsrv12 binding to the 8443 port, is that correct?

Can you stop the SEPM services (especially the Embedded DB service), run a netstat to check that nothing is listening on 8443/2638, before then starting the Embedded DB service again?

Like you mentioned earlier, it might be faster all round to just perform a DR.  But this depends on how recent your last backup was, and if we're abel to clear the machine of any port conflicts before the restore.

Yes this is correct i have attached a netstat with all SEPM services stopped

Hope this is of use cheers