Endpoint Protection

 View Only
Expand all | Collapse all

SQL Event Log SChannel issues after SEP Upgrade

  • 1.  SQL Event Log SChannel issues after SEP Upgrade

    Posted Sep 19, 2017 07:18 AM

    Hello all,

    Here is my case:

    We had a SEP 12.1.6 MP5 with external DB connection to our SQL System (SQL Standard 2012   11.0.6523.0)

    I want to migrate our SEPM System to a new VM so i did these steps

    1. On the OLD i did Upgrade to latest Version 14.0.0 MP2 withoun any issue

    2.On the New VM i installed Same Version "14.0.0 MP2" and i connected to the same external SQL DB with the configuration Wizard as a failover server.

    3. I Created a new Management server Policy with the New Server and applied to the Group Of clients so they will connect to the new system.

    4. All clients that point to the new they connect without issues (All running fine).

    Now to my issue:

    Since i upgraded to v14.0.0 MP2 i have a lot of errors (every 2min) on SQL server side under "System Event Log" about schannel. I dont know if they come from a connection from the old or from the new system. I suppose they come from both

    Event ID 36888 

    The following fatal alert was generated: 20. The internal error state is 960.

    Based on this (support.microsoft.com/en-us/help/3135244/tls-1-2-support-for-microsoft-sql-server) my SQL version supports  TLS

    How can i resolve the issue without disabling the Schannel Event Log?

    Thanks in advance,

    Andreas



  • 2.  RE: SQL Event Log SChannel issues after SEP Upgrade

    Posted Sep 22, 2017 07:44 AM

    Hello,

    Any advice?



  • 3.  RE: SQL Event Log SChannel issues after SEP Upgrade

    Posted Dec 06, 2017 01:09 PM

    We would be interested in this issue as well.  We just moved the Symantec V14.0.0 MP2 database from SQL 2008R2 SP2  to SQL 2014 SP2 CU7.  The Schannel errors stopped on the old SQL server environment and now started on the new SQL server environment. 

    It would be better to know the reason for this event message versus shutting off the alert that is filling up the Windows event log terribly.