Endpoint Protection

Not sure what happened but I got approximately 25 emails from 8:38pm EST yesterday to 7:47am EST this morning saying "Database is down" from 2 of my SEPM servers.

Here is the body of the email:

From: SYSTEM@server name.com <SYSTEM@server name.com>

To: itsupportdesk.com <I.T. Support Desk>

Subject: Database is down 

Message from:

      Server name: server namer

      Server IP: 192.168.000.00

The Symantec Endpoint Protection Manager database has gone down and needs immediate attention.

Just a note...I changed some of the company info so don't worry about the IP address.


How do I stop so many of these emails from coming through?

Hi,

can you physically check whether you are able to login to SEPM and see whether its functioning properly.

Which DB are you using?? WHat is the version of SEP??

Rgrds,
SAM

hi,
as Sam mentioned , please check if the SEPm service is up and also DB is running. Check for the event id's and serach for the KB article.
You have the timestamp in the mail, you can check for the event id associated at that time. I guess it may not stop DB services for all time, for a moment it may have restarted..

Pete!!

I would like to know the cause of the database failure, or at least a suspected cause. Any help would be great as the support site has no reference to this.

first check whether database is working or not.

If you are listed as admin on SEPM, you will receive these messages. The message are only send when the DB is actually down, or if SEPM wasn't able to access the DB.

What version are you running? We used to have the databse stop without finding a cause and then got the subsiquent warning email until the current version 11.0.4202_MR4_MP2. So the first question is what version are you running. The second, are you running USB monitoring or managment?

We are having a simmilar problem, messages are being generated to the OP.

 

Message from:

            Server name: x

            Server IP: y

The Symantec Endpoint Protection Manager database has gone down and needs immediate attention.

The service Symantec Embedded Database is still running and a restart appears to complete but does not resolve the issue.  SEPM Console will load but does not work correctly as all the views on the first page do not display any data and thereafter the system repeatedly asks you to sign in.  Looks on the face of it as if the database is down but have no way of getting at it and diagnosing it.  Where do you start with the embedded Symantec database?

SEPM 11.0.3001.2224
Server 03
Java 6 U15

Check in the log file (scm-server-0.log) which is situated in \Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\logs something unusual is present 

 If you are getting a message as "Unable to communicate with the reporting component" after logging into the Symantec Endpoint Protection Manager try this doc.
http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/beb4238fecda37a588257433006db633?OpenDocument.

We had a few instances of this a few months back due to sizing of our environment. We had two virtual SEPMs in one region replicating with two other regions. As we stepped up our rate of deployment, the clients in region one began posting logs at a rate the SEPM server could not keep up with. Our DB admin looked at the database (I am not a DB expert) and identified some tables which were particularly problematic and causing database issues. We reduced the log retention to bring down the table size which helped considerably, and put an additional SEPM server in place to help log processing. I believe upgrading SEPM to MR4 MP2 also improved databse indexing and performance - we will be evaluating RU5 to see if it offers any further improvement.

Our issue occurred beyond 10000 clients in that region, but client count is not the only factor involved.

Some things to consider:
Number of clients
Heartbeat interval
Number of SEPM servers
spec of SEPM server(s)
embedded DB SQL
if SQL, spec of server
Is the SEPM already busy with definition distribution? Offload this to GUPs and LiveUpdate points as much as possible.

One clue that something was amiss was that the details on Console Home Page were lagged in relation to client status due to the fact that the SEPM had a backlog of logs to process so the summary was out of date.

In fact what I mean with something unusal is the the error messages like “sem5 transaction log full” in that scm-server-0.log file.Whether you tried to repaid ur sepm installation ,if no try that.

 

• Click Start Menu> Programs> Administrative Tools> Data Sources (ODBC) <o p=""></o>
• Click System DSN <o p=""></o>
• Select SymantecEndpointSecurityDSN <o p=""></o>
• Click Configure <o p=""></o>
• Select Database <o p=""></o>
• Enter your server's hostname in the "Server name" field <o p=""></o>
  • Enter the hostname, rather than the Fully Qualified Domain Name (FQDN)<o p=""></o>
• Type sem5 in the "Database name" field <o p=""></o>
• Click OK <o p=""></o>
• Click OK <o p=""></o>
• Stop the "Symantec Endpoint Protection Manager" service <o p=""></o>
• Stop the "Symantec Embedded Database" service <o p=""></o>
• Start the "Symantec Endpoint Protection Manager" service <o p=""></o>
• Start the "Symantec Embedded Database" service<o p=""></o>

Pls tell us whether above steps helped you.If no pls give some more informations(Database &log file size,total no. of cients(approx.),h/w configuration of sepm etc.)

 

Hi,

Thanks for the responses, have run through the previous recommendation regarding ODBC to no avail.  As regards the ammound of data or logging that may have accrued there is a negligable ammount as this is a trial implementation that has 5 users on it (we are currently migrating from SAV, or trying to at least).  If we can make SEP fall over on a brand new 8 core box with a userload of 5 I think we have an issue.

Just recently we started getting these emails about the database is down.
With all posts above there seems to be no answer or resolution. Is there a way to stop the emails? Is this a serious issue? or does the DB just go down from time to time?

Our version of SEMP is 11.0.5002.333
nothing really fits from the logs. and we have only gotten the email twice now.

What is the cause of the DB connection loss? Updates? Network? Something else?

thanks

I have seen this issue twice now and both times it seems to be fixed by running the dbvalidator.bat in the tools folder.

  install-drive:\Program files\Symantec\Symantec Endpoint Protection Manager\Tools

   This solution worked for me running 2003r2 x86 in Hyper-V running the dbase on different server. I ran the DBvalidator.bat on the console server reporting the problem.