Endpoint Protection

I have installed SEPM MR4 on Windows Server 2008. When I try to start the SEPM service it stops almost immediately and I get the following error in the Windows event log:

Log Name: Application
Source: semsrv
Date: 5/8/2009 4:38:07 PM
Event ID: 4096
Task Category: None

Description:
The Java Virtual Machine has exited with a code of -1, the service is being stopped.

Here is the scm-server-0.log output:

2009-05-08 16:38:04.944 SEVERE: ================== Server Environment ===================
2009-05-08 16:38:04.944 SEVERE: os.name = Windows Vista
2009-05-08 16:38:04.944 SEVERE: os.version = 6.0
2009-05-08 16:38:04.944 SEVERE: os.arch = x86
2009-05-08 16:38:04.960 SEVERE: java.version = 1.5.0_15
2009-05-08 16:38:04.960 SEVERE: java.vendor = Sun Microsystems Inc.
2009-05-08 16:38:04.960 SEVERE: java.vm.name = Java HotSpot(TM) Server VM
2009-05-08 16:38:04.960 SEVERE: java.vm.version = 1.5.0_15-b04
2009-05-08 16:38:04.960 SEVERE: java.home = C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\jdk\jre
2009-05-08 16:38:04.960 SEVERE: catalina.home = C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat
2009-05-08 16:38:04.960 SEVERE: java.user = null
2009-05-08 16:38:04.960 SEVERE: user.language = en
2009-05-08 16:38:04.960 SEVERE: user.country = US
2009-05-08 16:38:04.960 SEVERE: scm.server.version = 11.0.4014.26
2009-05-08 16:38:04.976 INFO: Server startup
2009-05-08 16:38:06.255 FINE: updProcessState: checking...
2009-05-08 16:38:06.270 FINE: updProcessState: The process status has been checked.
2009-05-08 16:38:06.270 FINE: updProcessState: checking...
2009-05-08 16:38:06.286 FINE: updProcessState: The process status has been checked.
2009-05-08 16:38:06.879 SEVERE: ================== StartClientTransport ===================
2009-05-08 16:38:06.957 SEVERE: Unknown Exception in: com.sygate.scm.server.servlet.StartupServlet
java.lang.Exception: HTTP 500 Internal Server Error, URL: http://localhost:8014/secars/secars.dll?action=34
at com.sygate.scm.common.communicate.Communicator.getRequestInputStream(Communicator.java:556)
at com.sygate.scm.server.util.ClientTransportHelper.startClientTransport(ClientTransportHelper.java:72)
at com.sygate.scm.server.servlet.StartupServlet.init(StartupServlet.java:104)
at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:880)
at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:768)
at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3484)
at org.apache.catalina.core.StandardContext.start(StandardContext.java:3710)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
at org.apache.catalina.core.StandardHost.start(StandardHost.java:697)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:311)
at org.apache.catalina.core.StandardService.start(StandardService.java:450)
at org.apache.catalina.core.StandardServer.start(StandardServer.java:2213)
at org.apache.catalina.startup.Catalina.start(Catalina.java:484)
at org.apache.catalina.startup.Catalina.execute(Catalina.java:371)
at org.apache.catalina.startup.Catalina.process(Catalina.java:134)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:151)
com.sygate.scm.common.communicate.CommunicationException: Unexpected server error. ErrorCode: 0x10010000
at com.sygate.scm.common.communicate.Communicator.getRequestInputStream(Communicator.java:580)
at com.sygate.scm.server.util.ClientTransportHelper.startClientTransport(ClientTransportHelper.java:72)
at com.sygate.scm.server.servlet.StartupServlet.init(StartupServlet.java:104)
at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:880)
at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:768)
at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3484)
at org.apache.catalina.core.StandardContext.start(StandardContext.java:3710)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
at org.apache.catalina.core.StandardHost.start(StandardHost.java:697)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1148)
at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:311)
at org.apache.catalina.core.StandardService.start(StandardService.java:450)
at org.apache.catalina.core.StandardServer.start(StandardServer.java:2213)
at org.apache.catalina.startup.Catalina.start(Catalina.java:484)
at org.apache.catalina.startup.Catalina.execute(Catalina.java:371)
at org.apache.catalina.startup.Catalina.process(Catalina.java:134)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:151)

This line stands out:
java.lang.Exception: HTTP 500 Internal Server Error, URL: http://localhost:8014/secars/secars.dll?action=34

I've checked permissions per some articles I've seen here and they look good. Any ideas?

Is this a 64-bit version of Windows Server 2008? IIS might be set to 32 bit mode while it should be 64 bit obviously if you are running 64 bit.

Grant-

I'm running 64-bit IIS. I can pull up the default web page fine.

https://127.0.0.1 - comes up ok

http://127.0.0.1:8014 - blank (no error message)

http://127.0.0.1:8444 - "Can't establish connection"

Curious - Do I need to put my .slf (license file) anywhere for this to work?

I only ask about the license file since I saw this in the catalina.out log:

May 8, 2009 5:20:44 PM org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-9090
May 8, 2009 5:20:45 PM org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-8444
Starting service SCM
Apache Tomcat/4.1.37-LE-jdk1.4
Has valid SAV license
Info>> No SNAC license file in C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\license
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: ================== Server Environment ===================
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: os.name = Windows Vista
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: os.version = 6.0
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: os.arch = x86
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.version = 1.5.0_15
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.vendor = Sun Microsystems Inc.
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.vm.name = Java HotSpot(TM) Server VM
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.vm.version = 1.5.0_15-b04
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.home = C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\jdk\jre
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: catalina.home = C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: java.user = null
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: user.language = en
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: user.country = US
May 8, 2009 5:20:45 PM com.sygate.scm.server.util.ServerLogger writeHeader
SEVERE: scm.server.version = 11.0.4014.26

The reason I asked about the 64 bit is because when installing the SEPM, IIS gets set to 32 bit mode. This used to happen with Windows Server 2003. The solution was to switch IIS to 64 bit through this article http://support.microsoft.com/kb/894435, and then restart the SEPM. You might want to make sure, and maybe read through that microsoft article. I didn't see that bit about the license file the first time I read the log. I am looking into that now to see what needs to be done. Thanks.

Grant-

I as per experiance it is a JRE issue. Which version of java u r using?? Try to install JRE 1.5 or above. It is advisable not to use JRE 1.6 cuz it has some buggs in it.

Ajit

Hi,

for sure you don't have to be worried about the license, SEP 11 is unlicensed. The .slf file is some other products sold in the same package.
This is the real test for IIS:
http://localhost:8014/secars/secars.dll?hello,secars
Unfortunately the http error 500 is very hard to troubleshoot because it is a too general.
Sometimes it is worth to reinstall or repair the SEP Manager.
Be aware that IIS 7 has to set to act like IIS 6.

Regards,

I know this is not your exact problem, but check this link to see if it helps:
https://www-secure.symantec.com/connect/forums/403-errors-windows-2008-server

Also, if you are trying to run the console on the server where you installed SEPM itself, it doesn't require JRE, because SEPM uses an internal version of JRE.

https://www-secure.symantec.com/connect/forums/upgrading-sep-management-server-2k8
https://www-secure.symantec.com/connect/forums/cant-connect-sepm-console-service-stops-java-1-error

Hi xesangel, 
have you tried to increase the java heap size, try the following....

To adjust the Symantec Endpoint Protection Manager heap size:

Click Start> Run.
Type regedit
Press Enter.
Locate the following registry key:
HKLM\SYSTEM\CurrentControlSet\Services\semsrv\Parameters\

Locate the following keys:
JVM Option Number 0
JVM Option Number 1

Adjust the key values upward, and match the key values.
For example, to create a 1 GB static heap, set the JVM Option Number 0 to -Xms1024m, and set the JVM Option Number 1 to -Xmx1024m.
Exit Regedit.
Click Start> Settings> Control Panel> Administrative Tools.
In the Services dialog box, right-click Symantec Endpoint Protection Manager, and then click Restart.

When entering the below URL I get a "HTTP 500 Internal Server Error".

http://localhost:8014/secars/secars.dll?hello,secars 

I have IIS7 installed with IIS6 compatability. Is that what you mean?

Hi,

unfortunately I have to confirm that it is not easy to troubleshoot an HTTP 500 error. Try to reinstall. The Technical Support could be useful.

Hi,

        Since you are getting an 500 error try the following steps and let us know whether it helped.

1. Right click the Symantec Endpoint Protection Manager folder, then click Properties.
Default path: C:\Program Files\Symantec\Symantec Endpoint Protection Manager

2. Click the Security tab.
3. Click Advanced, then un-check Allow inheritable permissions from the parent...
4. Click Copy, then click OK.
5. Ensure that the following permissions are set for the following groups:
Administrators - Full Control
SYSTEM - Full Control
Users - Read & Execute, List Folder Contents, and Read.

6. Evaluate any additional groups to ensure they are not set to deny access.
7. Click Advanced, then check Replace permission entries on all child objects...
8. Click OK, then click Yes. A security window will pop-up showing status, then disappear.
9. Click OK.
10. Double-click the Symantec Endpoint Protection folder.
11. Right-click the data folder, then click Properties.
Default path: C:\Program Files\Symantec\Symantec Endpoint Protection\data

12. Click the Security tab.
13. The default permissions for this folder are Everyone - Full Control.
14. To add Everyone:
a. Click Add...
b. Click Advanced, then click Find Now.
c. Click Everyone, then click OK, then click OK again.
d. Click Advanced, then un-check Allow inheritable permissions from the parent...
e. Click Remove, then click OK.
f. Click Replace permission entries on all child objects...
g. Click OK, then click Yes. Click OK, then click OK again.

For Endpoint Protection MR2 and later there is an additional folder used by Php.
To make the Php temporary folder permissions similar to those set by a default installation of Windows 2003 Standard with a default installation of the Symantec Endpoint Protection Manager:

Right click the temp folder, then click Properties.
Default path: C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection Manager\Php

Click the Security tab.
Click Advanced, then un-check Allow inheritable permissions from the parent...
Click Copy, then click OK.
Ensure that the following permissions are set for the following groups:
Administrators - Full Control
Internet Guest Account - Full Control