Endpoint Protection

Dear Community!

I've recently got an email from the management server, saying database is down, need attention.

The last changes I've made on the server is: changed a shared firewall -and centralized exceptions policy (added a tamper protection exception)

After several hours, the database went down.

I tried to start the service, but it starts then immediately stops.

Tried to test the ODBC connection (it's an embedded database), but it drops an error (same error I see in the windows event log)

I attached the error to this post.

I cannot restore the database (because the service is down, the restore tool not working)

Symantec Management server "Repair" and database reconfigure is not working either.

it's a windows 2003 x64 R2 server

Any help would be appreciated.

Hello,

What Database are you using?? SQL or Embedded??

If you have installed SEPM with Embedded database:

There are 2 things to look in here.

1) When you go to the Services.msc, check if Symantec Embedded Database Service is running or not??

2) When you open the Task Manager, under Processes, you may see the dbsrv11.exe, is that running??

Run the DbValidator from

Run the Windows Command Prompt (cmd.exe) as Adminstrator, then navigate to:
\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Tools\
And run dbvalidator from there.

If you have installed SEPM with SQL database:

Check SQL server

Check if the SQL client is running.

Check ODBC connection

Hope this helps!!!

HI i have a good solution if it is embedded database

restart your server, check whether your database service is stopped, if stopped

go to the database file location where in you will be finding the file name "sem5.log" and rename to "sem5.log.old"

you can find the file by using windows search obviously it will be under symantec folder

then try to force start the database

you can use windows search to find the file "dbsrv9.exe" which will be under symantec folders

go to the file location "dbsrv9.exe", issue the following command

"dbsrv9 -f "(sem5.db file location)" for eg., "dbsrv9 -f "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db\sem5.db"

now your "symantec embedded database" service will be started, try to restart the services under services.msc

1) When you go to the Services.msc, check if Symantec Embedded Database Service is running or not??

as I said earlier: "I tried to start the service, but it starts then immediately stops."

2) When you open the Task Manager, under Processes, you may see the dbsrv11.exe, is that running??

Of course not running, because the service stops.

Run the DbValidator from...

Not working because the service is not running.

It's working, altough I use 12.1 and the file name was dbsrv11.exe

dbsrv11 -f "C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\db\sem5.db sucessfully started the database, and then I could start the embedded service.

Any clue why was that happened? I want to anticipate another database error.

It was not working beacause it couldnt update on the previous log file "sem5.log" so thats the reason we had renamed the old file to "sem5.log.old"

Cheers!!!!!!!

Thanks, it was a lifesaver, but the database keeps going down in 1-2 days. Now it has gone down, and cannot start even with your solution.

Tha last error was:

E. 09/16 08:56:14. *** ERROR *** Assertion failed: 200114[sem5] (11.0.1.2472)
Can't find values for row a28b:3 in index 'I_ALERTS_ALERTDATETIME_PARENTSERVER_IDX'

how is that possible, that it cant write to the log? I want to make a permament solution. Should I write a ticket to Symantec?

...as the only articles I can find relating to your issue are for v11.  These are listed below:

Thanks for the response, this article:

How to rebuild the embedded database for Symantec Endpoint Protection Manager - http://www.symantec.com/docs/TECH162743

works, but its still a temporary solution, after 1 day, the database still gone down.

dbsrv11.exe = Sybase SQL Anywhere v11

Have you tried a Re-Configuration of the SEPM?

If nothin helps... maybe you re-create your SEP Infrastructure to test why it's going down or build up a new one with imported stuff from the old 1 (without db restore)

try to reconfigure using management server configuration wizard

and also try to upload the log file let you know the result...

Guys, please read my first post before asking trivial things.

However I think I know what was the error. I switched off application learning both on the server and in the Communication Settings, and the database seems to be in tact for the last two days.

Anyone knows a way to clean up the learned applications list from the database to make it smaller?