Endpoint Protection

Good morning,

  Since updating SEPM to 12RU1MP1, whenever we get a Single Risk Event we're getting an e-mail every 3 minutes for roughly an hour on the same event.  I've tried deleting the notification condition and recreating it but the results are the same.  I tried changing the damper from auto to an hour as well but again, the results were the same.  This was not an issue for us in 11RU7. 

  Anyone else experiencing similar issues or know what can be done to correct this?

  Thank you.

How many logins do you have for SEPM? Are there more than one person trying to access SEPM?

Login as an Admin which has all privileges and also make sure that its password is set to never expire. And then delete the existing notification and then re-create the same and see if it helps.

Hello,

Symantec is aware about this issue. The Issue seems to have been resolved in the Upcoming Version of SEP 12.1 RU2

I would request you to create a case with the Symantec Technical Support on the same.

QuickStart Guide - Create and Manage Support Cases in SymWISE

http://www.symantec.com/docs/HOWTO31132

How to update a support case and upload diagnostic files with MySupport

http://www.symantec.com/docs/TECH71023

OR

To Call Symantec Technical Support :

http://www.symantec.com/business/support/assistance_care.jsp

http://www.symantec.com/enterprise/support/contact_techsupp_static.jsp

Hope that helps!!

I created a case on it and have tried creating the notification with the admin role instead of a domain admin. I'll monitor until we receive a new notification and follow up.

We received our first alert after recreating the notification with the admin (not domain admin, which we had already tried).  Still receiving notifications every 3 mins for the same alert. 

Was the original admin that created the alert deleted from the system without first deleting the alert?

Nope.  Admin created the original alert.  I deleted it and created it again (domain admin).  Then I deleted the one created by the domain admin and created it as an admin.

Additional improvements are expected in the next release of SEP 12.1. 

Multiple Symantec Endpoint Protection Manager email notifications are sent for old events

http://www.symantec.com/docs/TECH144817

Supplemental Materials

That article states a fix for 12.1 was employed in SEP 12.1 RU1.  We're on 12RU1MP1 and this is an active issue for us.  What was the fix mentioned? 

We are on Version 12.1.1101.401 RU1 MP1 and have the same issue. I am tried of getting all of these emails! Please help.

This issue is not fixed yet. The fix might be available in SEP 12.1 RU1 MP2. Symantec will release this 12.1 RU1 MP2 soon because its a global issue 

Is MP2 out yet?

No.

There is no official date for the release. You may see the Release of SEP 12.1 RU2 will be released anytime this year.

As of now, the SEP 12.1 RU2 is under BETA testing.

Incase, if you are interested in Beta Testing for SEP 12.1 RU2, check this :

https://symbeta.symantec.com/callout/?callid=1D5D3DD349C248E69B13977DA4DBF426

there is nothing like ru1 mp2, it will be SEP 12.1 RU2.