Endpoint Protection

Hi, I am running SEP 12.1 RU1 and suddenly today the SEPM service stopped. I tried to start it manually but after a few seconds it stopped again. I checked the event log and it says soemthing like "The Java Virtual Machine has exited with a code of -1, the service is being stopped" with the event id 4096.

I updated the JRE to the latest version still its not working.

The OS is Windows 2003 Standard SP2 32bit

any suggestions?

Thanks

try this document, u r running on 32 bit or 64 bit os?

http://service1.symantec.com/SUPPORT/ent-security.nsf/2326c6a13572aeb788257363002b62aa/86368136366e1ad78025734e004734d9?OpenDocument

Iam running 32 bit OS. most of the steps on that article is abount IIS but SEP 12.1 does not use IIS it uses Apache

 

Hi,

try repairing the SEPM using add/remove program. If it does not help, post the scm-server-0.log after you try login/restart the SEPM service. The log path

\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\logs

This is the log of Catalina.out

 

pass on scm-server-0.log located under tomcat\logs of SEPM install directory.

Here are the scm-server-0 log,

 

 

free up the space on the drive and restart the SEPM service and try login.

That might fix the problem because I just realized that there is only 2 GB free space in C drive.

But how did you come to this conclusion from logs?

from logs, though not related to login

Hi,

After reviewing the logs, it shows there is some problem with the disk space. Please make sure you have suffecient disk space. if not than try to make some free space and reboot the server. It will work....  

 

 

 

Thanks

Manish Vats

Hi

 

See the attached

You can try this also

Symantec Endpoint Protection Manager service stops with a Java -1 error in the event log
http://service1.symantec.com/support/ent-security....

 

You can also tray this :

 

Solution:

This problem can have several different causes. Most common are problems connecting to the database but examine the full list of possible causes below. This issue can happen if the SEPM web server in IIS is set to bind to a specific IP address instead of (All Unassigned) which is the default. To correct this go to the Properties dialog of the Default Web Site (or the site configured during the install) in the IIS management console and change the IP address binding back to (All Unassigned). If running on a 64bit machine IIS needs to be in 64bit mode(default but can be changed by other programs if IIS is running other sites before the install of the manager. If you see this error just after an install or a database reconfiguration or restore then the error might be caused by incomplete database settings. Open up the "Management Server Configuration Wizard" from the start menu and walk through the "Reconfigure the management server" wizard to make sure all settings for the database are correct. Once this is completed the Symantec Endpoint Protection Manager service should start properly again. If configured to use a Microsoft SQL server and the database is down or the machine unreachable this can also cause the SEPM service to shut down. Verify the connection to the SQL database from the SEPM machine. If configured to use the embedded database verify that it is running and reachable. Verify that the "Symantec Embedded Database" service is running and that the dbsrv9.exe process is listening on TCP port 2638. If there is already an application listening on one of the TCP ports the console is configured to use it can also cause the service to fail. Verify that no other process is listening on TCP ports 8443, 9090 or 8005 See this article for more information: "Which communication ports does the Symantec Endpoint Protection Manager 11.x use?" This issue can occur if folder permissions are not correct on the "Symantec Endpoint Protection Manager" folder. Verify that "Users" have at least "Read & Execute", "List File Contents", and "Read" permissions on the "Symantec Endpoint Protection Manager" folder. If the above solutions do not help, then enable debug logging of the Symantec Endpoint Protection Manager to gather more information about the problem. Open the file C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\conf.properties for editing. Add the line scm.log.loglevel=fine to the bottom of the file. Try restarting the Symantec Endpoint Protection Manager service again. After the service has stopped look for hints to the problem in the catalina.out and scm-server-0.logfiles located in the "Symantec Endpoint Protection Manager\tomcat\logs" folder. See the article "How to: Debug the Symantec Endpoint Protection Manager (SEPM) 11.x console" for more information"

 

References:

This document is available in the following languages: Brazilian-Portuguese: http://service1.symantec.com/SUPPORT/INTER/ent-securityintl.nsf/br_docid/20080226133558935 French: http://service1.symantec.com/SUPPORT/INTER/ent-securityintl.nsf/fr_docid/20080229133831935 German: http://service1.symantec.com/SUPPORT/INTER/ent-securityintl.nsf/de_docid/20080229133858935 Italian: http://service1.symantec.com/SUPPORT/INTER/ent-securityintl.nsf/it_docid/20080229133925935 Spanish: http://service1.symantec.com/SUPPORT/INTER/ent-securityintl.nsf/es_docid/20080226133641935

 

 

Your problem will be resolve.

 

 

 

Baljeet Singh

Hi,

Repair sepm & reconfigure the management wizard & then see services.

I created about 18GB of free space in the C drive and repaired the SEPM installation and reconfigured the management server. Still the service is not running for more than 10 seconds. below are the events that are happening in those 10 sec

 

pass on the new logs (scm-server-0.log)

Just try checking the status of  dependencies service in administrative tool and services and select SEPM

This service has only one dependency SEPM Webserver which is running fine.

 

The scm-server-0.log has not changed, its same as before

enable the logging to finest and attempt to login. The entries should be written into the logs. also pass on the catlina.out

HI

have you done any software upgradation/changes  to the server .if yes , then for testing purpose revert the changes and check the condition.

if you have not done any changes then i think you have to remove SEPM and once again install fresh copy of SEPM

 

it may solve your problem

Hi, I added the line scm.log.loglevel=finest to the file conf.properties, restarted the server and tried to login, still the scm-server-0.log has not changed its same as before which is given in the earlier post, you can see the last date on that log is of 1st Feb, it has not changed after that I tried with Fine and Finest both.

 

Catalina.out

 

Reconfigure the Mangement Server Wizard Console

Regards

What is Reconfigure the Mangement Server Wizard Console? I know only one kind of reconfiguration of server which is available from the start menu, and already did that 3 times

 

While reconfiguring the server, I think it should give any message that its success or something, but its getting ended while preparing and initializing the database.

I am not sure if the reconfiguration is completing successfully or not. How do I ensure that?

did you attempt to login after restarting the SEPM service?

 open a support case.

When changing the port for clients to communicate to the Manager in IIS, it is also necessary to change the IIS HTTP port value in Tomcat, so that Tomcat knows what port to use to communicate with IIS.

For information on making this change, please refer to the following document: How to Change the Communications Management Port for SEPM and SEP Clients

Regards
 

Mahendra, did you find a solution for this problem?  I am now facing the exact same issue.

I "fixed" this by following this Disaster Recovery article.