Hello all!

For the past few weeks I've been seeing this error message pop up on two of our clients.

Event ID: 74
Event Description: SONAR has generated an error: code 0: description: Definition Failure

This occurs after every definition update.

Near as I can tell the Sonar definitions are up to date and are getting downloaded properly to the client.  Most of the tech articles I've looked at seem like they're for if the Sonar definitions aren't getting downloaded to the client.

Not sure where to start looking for a solution at this point.  I'd rather avoid just blindly deleting registry keys and rebooting servers when I'm not exactly certain what's going on with this error message.

Thank you for your time.

What's the exact version of SEP you're using? What date are you showing for it, latest is 11/1/13 r11

Have you tried a repair on the client?

Follow the steps here and only clear out BASH defs

How to clear out definitions for a Symantec Endpoint Protection 12.1 client manually

“Download Insight is malfunctioning” appears after upgrade from SEP 11.0 to SEP 12.1
Fix ID: 2496842
Symptom: When a SEP 11.0 client is upgraded to SEP 12.1, the following message appears in SEP UI:

Download Insight is malfunctioning
In addition, the event log contains the following error:
Event ID 74 "SONAR generated the error: code 0: explanation: Definition error"

Solution: If the SEPM database does not yet include LiveUpdate content, the auto-upgrade process copies the content from the full package to create a delta for the

New fixes and features in Symantec Endpoint Protection 12.1 Release Update 1

http://www.symantec.com/business/support/index?page=content&pmv=print&impressions=&viewlocale=&id=tech174565

My apologies, forgot to include relevant version information.

Running 12.1.4

Heuristics engine 12.1 RU2 Revision 11/01/2013 r11
Commercial application engine 11.0 Revision 09/29/2008 r16
Scan data 11.0 Revision 08/20/2008 r1
Scan engine 11.0 Revision 08/20/2008 r1
Scan whitelist Revision 11.0 11/21/2013 r3

I compared these to other Servers we have that aren't having the Sonar issues and they match up.

I looked at that too, it doesn't seem to apply as we upgraded to 12.1 ages ago and this error just started happening a few weeks ago.  On the 13th of this month to be exact.

Run the SymHelp tool to check for errors

Troubleshooting computer issues with the Symantec Help support tool

Hello,

Ensure there is enough disk space on the client machines.

Secondly, Could you create a test group in SEPM and move both the clients to the test group .

Uncheck Policy Inheritance.

Disable the Sonar (in the new group)

Keep it for an hour depending on the set heart beat interval.

The clients will show SONAR disabled in the Event viewer and then move the clients back to its previous group.

Hope that helps!!

Didn't return any errors other then a handful of services don't start the recommended way.  They're all started though so I don't think that's the issue.  I've fixed the ones I could.

Giving the other recommended fix a try.  Just waiting now for errors to kick in before moving the computer back to its normal group.

Thanks Brian.

I moved the computer to another group, disabled policy inheritance, created a new policy with Sonar off and assigned it to that group.  New defs came in about an hour later and I still got a sonar error on the client.

Does this mean Sonar was still on despite me turning it off? Or is it indicating the error isn't linked to that?

Also there's 15 gb free on the drive so I imagine that's not the problem.

Thanks by the by.

Where is this error appearing, in what log on the client?

SEP client on the server running SEPM (for both customers).  These are two seperate entities by the way, we just manage both their networks.  None of the other clients reporting in to the SEPM have this issue.

Client Managemet -> System Log.

Attached a snip of the error log

Apologies if I should have posted this in the SEP sub-forum instead.  Didn't realize that existed until just now.  >_<

Were you able to try a repair on the client?

Sort of.  It says I need to reboot to complete the process and it's a production server that I won't be able to reboot for a few more days.

Hi

Can you try reinstalling the SEP client

Regards

Hi

Can you please update on the solution provided

Regards

He already said he needs a few days to in order to be able to reboot. Read his last post above.

Next reboot window is going to be on Tuesday morning so this is on the back burner for now.  I'm a little leery of doing a reboot of a production environment right before I leave on holiday but I'd like to get this sorted out.

I also forgot to mention Brian that I can't do the bashdef clear until then as well due to the reboot requirement.

Okay, THanks Brian.  I rebooted the server last Tuesday before Thanksgiving, ran the repair and then rebooted again this last Tuesday.  It's been a few days and we haven't seen a single Sonar error.  Looks like just repairing the client was all it took.

Great! I'm glad it's working correctly again.