Failed to start LSB: Symantec AntiVirus Scanner

October 18, 2019, 12:26 pm

≫ Next: Symantec is blocking Gmail Services like Docs,Calendar

≪ Previous: Does anyone know when SEP14.2 RU2 will be released?

I need a solution

I am attempting to install Symantec Endpoint Protection 14.2.4815-1100 on Red Hat Enterprise Linux 7.7 and I am able to install rtvscand and symcfgd but it does not like smcd. I decided to start from scatch and I'll post what I am doing. I'm not sure if this is important, but I noticed which I use the "check packages signature" option it outputs:

Checking signature on sep.rpm
sep.rpm signature verification FAILED
Packages signature serification failed.

Here is the output when I try to install it:

[root@servername Symantec]# ./install.sh -i
Starting to install Symantec Endpoint Protection for Linux
Performing pre-check...
Pre-check succeeded
Begin installing virus protection component
Preparing...                          ################################# [100%]
Performing pre-check...
Pre-check is successful
Updating / installing...
   1:sep-14.2.4815-1100               ################################# [100%]
Virus protection component installed successfully
Begin installing Auto-Protect component
Preparing...                          ################################# [100%]
Performing pre-check...
Pre-check is successful
Updating / installing...
   1:sepap-x64-14.2.4815-1100         ################################# [100%]
Auto-Protect component installed successfully
Begin installing GUI component
Preparing...                          ################################# [100%]
Performing pre-check...
Pre-check is successful
Updating / installing...
   1:sepui-14.2.4815-1100             ################################# [100%]
GUI component installed successfully
Pre-compiled Auto-Protect kernel modules are not loaded yet, need compile them from source code
Build Auto-Protect kernel modules from source code successfully
failed to start smcd .
Running LiveUpdate to get the latest defintions...
Update was successful
Installation completed
=============================================================
Daemon status:
symcfgd                   [running]
rtvscand                  [running]
smcd                      [stopped]
=============================================================
Drivers loaded:
symap_custom_3_10_0_1062_1_2_el7_x86_64
symev_custom_3_10_0_1062_1_2_el7_x86_64
=============================================================
Auto-Protect starting
Protection status:
Definition:     10/18/19 rev. 3
AP:             Enabled
=============================================================
The log files for installation of Symantec Endpoint Protection for Linux are under ~/:
sepfl-install.log
sep-install.log
sepap-install.log
sepui-install.log
sepfl-kbuild.log

Am I missing something here? It doesn't really tell me why it will not start.

↧

Symantec is blocking Gmail Services like Docs,Calendar

October 21, 2019, 3:43 am

≫ Next: Unable to add SHA256 hash values in application & device policy

≪ Previous: Failed to start LSB: Symantec AntiVirus Scanner

I need a solution

Hi,

I have configured a Firewall Rule to Block Youtube in Symantec EndPoint Protection, Youtube is successfully Blocked but Endpoint protection is also blocking Google services like Google Docs, Calendar.?

Any Solution?

Regards,

Irfan Ahmed

↧

Unable to add SHA256 hash values in application & device policy

October 22, 2019, 7:49 am

≫ Next: Cisco anyconnect and SEP

≪ Previous: Symantec is blocking Gmail Services like Docs,Calendar

I do not need a solution (just sharing information)

We are unable to add SHA256 hash values in application & device policy.

Please provide solution for the same.

↧

Cisco anyconnect and SEP

October 22, 2019, 9:47 am

≫ Next: Notification Events Timestamp: Client Time or Server Time?

≪ Previous: Unable to add SHA256 hash values in application & device policy

I need a solution

Hello there,

Is there anyone who is facing an issue with Ciscco anyconnect and SEP?

So when SEP's on the Cisco anyconnect does not connect I see Tamper Protection events.

Any Suggestions?

↧

Notification Events Timestamp: Client Time or Server Time?

October 22, 2019, 12:01 pm

≫ Next: Whitelisting binaries over 100MB size

≪ Previous: Cisco anyconnect and SEP

I need a solution

We have endpoints in many different timezones with our SEPM servers here in Eastern timezone. Notification Events show the event date/time... is that the client time or SEPM time?

↧

Whitelisting binaries over 100MB size

October 22, 2019, 12:24 pm

≫ Next: cloud enrollment issue

≪ Previous: Notification Events Timestamp: Client Time or Server Time?

I need a solution

Hi,

We have SEP 14 wrongly flagging some of our installers with reputation alert "WS.Reputation".

Binaries are all digitally signed ( singing cert rooted by well-known CAs); We ware able to fix this issue for binaries less than 100MB following the process outlined on Symnatec website.

Does anybody know what is the process for binaries over 100MB (we have several in 103 MB - 110 MB size range)? These false alerts are more than annoing.

Thank you,

Dragos.

↧

cloud enrollment issue

October 22, 2019, 2:29 pm

≫ Next: Chrome 78 Update & Symantec Endpoint Protection Issue!

≪ Previous: Whitelisting binaries over 100MB size

I need a solution

we are using SEPM 14.2 Ru1 Mp1. we can enroll the SEPM to cloud successfully but it's unenrolled after 5 min any idea

↧

Chrome 78 Update & Symantec Endpoint Protection Issue!

October 23, 2019, 12:39 am

≫ Next: Clients logging to remote replication sites

≪ Previous: cloud enrollment issue

I need a solution

Hi, Few hours ago Google released Update 78 for Chrome and since then it's seems to be broken for symantec endpoint protection users.

The problem is you can't load any pages, You will get "Aw, Snap" Error.

The workaround I found was to launch chrome with no sandbox:

Chrome.exe --no-sandbox

Anyone know a permanent solution?

My symantec endpoint protection version is 14.0 MP1

1571819261

↧

Clients logging to remote replication sites

October 23, 2019, 2:40 am

≫ Next: Report Showing Clients Firewall Status = "Not Installed"?

≪ Previous: Chrome 78 Update & Symantec Endpoint Protection Issue!

I need a solution

We have an environment with several replicaiton partners.

We are seeing clients on remote replication sitres logging acrivity to the sem5 database on remote SEPM sites on a different location.

Any idea whats happening here?

Thanks,

↧

Report Showing Clients Firewall Status = "Not Installed"?

October 23, 2019, 6:15 am

≫ Next: Any known issues with SEP 14.2 and later versions with Server 2016?

≪ Previous: Clients logging to remote replication sites

I do not need a solution (just sharing information)

Among our thousands of clients I'm seeing some get the basic protection client installed rather than the full protection. I'd like to identify them but I'm not seeing any way to do that in "Monitors" or "Reports". I thought about using the REST API but I suck at scripts. I also looked at the database to see if I could come up with a SQL query but can't figure that out. Any suggestions? Thanks.

↧

Any known issues with SEP 14.2 and later versions with Server 2016?

October 23, 2019, 7:53 am

≫ Next: issues setting up second managment server

≪ Previous: Report Showing Clients Firewall Status = "Not Installed"?

I need a solution

Previous versions of SEP have affected windows updates in Windows server 2012 R2. The only way to install updates was to disable SEP while updates were being installed.

Are there any known issues with SEP 14.2.770 and later versions that affect Windows Server 2016 windows updates?

Thanks

↧

issues setting up second managment server

October 23, 2019, 2:12 pm

≫ Next: SEP Learned Applications - auditing application versions

≪ Previous: Any known issues with SEP 14.2 and later versions with Server 2016?

I need a solution

14.01

first management server is using embeded database.

installing symantec endpoing on second server, selecting option to install additional managment server to existing site.

when I get to Database Server Authentication I have two options, SQL server authentication, and Windows Authentication.

tried windows authentication but no go, and try SQL server authentication and it fails as wellm error 11501.

notes show username for DB is DBA, and we have notes for the password, but not sure of the database name, it defautls to sem45.

how can I verify the correct database name for an embedded database on the other server.

↧

SEP Learned Applications - auditing application versions

October 23, 2019, 9:53 pm

≫ Next: SEPM 14.2 - REST API - Accessing Hardware Devices list

≪ Previous: issues setting up second managment server

I do not need a solution (just sharing information)

Hi,

We have around 80 client workstations that we'd like to audit for application version changes (e.g. firefox.exe), so that we can determine whether a specific version has been installed on all workstations for compliance.

What we really would like is to be able to syslog each time a client workstation changes the version of an application (the syslog entry would need to include the client name, executable name, version, and time).

We cannot see an obvious way to achieve this. Has anyone used SEPM for this prupose?

Cheers
Rod

↧

SEPM 14.2 - REST API - Accessing Hardware Devices list

October 24, 2019, 2:36 am

≫ Next: SEP Server in DR with different ip address

≪ Previous: SEP Learned Applications - auditing application versions

I need a solution

Hello everybody,

I'm trying to use the SEPM 14 REST API to perform some processing in Powershell. I need to get the "Hardware Devices" list (can be found in your SEPM under Policies > Policy Components > Hardware Devices).

At the same place, you can find the fingerprint list that you can retrieve thanks to that URI : https://apidocs.symantec.com/home/SAEP#_getfilefingerprintlist

GET /api/v1/policy-objects/fingerprints/{id}

I didn't manage to find something like /api/v1/policy-objects/hardware-devices

Is that a miss in the API description or does this feature isn't supported yet ?

Thank you for your help,
Regards,

↧

SEP Server in DR with different ip address

October 24, 2019, 9:18 am

≫ Next: SEP Mobile and SSL connections

≪ Previous: SEPM 14.2 - REST API - Accessing Hardware Devices list

I need a solution

Hi all, question , were looking to have a DR site. So our VM windows 2012 server with SEP 14 called (NAV1 ip address 172.16.7.50) with SQL installed on a different server (SEPSQL ip address 172.16.7.51). so all of our windows clients talk to this server. so when a DR event happens all of our replicated servers on the DR side with have a different subnet supposably like NAV1 will be now 172.16.8.50 and NAVSQL will be 172.16.8.51. so what we are told with from our consultants as long a the server relyies soley on DNS it will be fine. i didnt open a call yet with symantec but has anyone encountered this scienero ? does anyone here know is my SEP farm will still work or will i have issue? thanks everyone

↧

SEP Mobile and SSL connections

October 25, 2019, 6:00 am

≫ Next: How to reset Symantec Endpoint Protection Manager password

≪ Previous: SEP Server in DR with different ip address

I do not need a solution (just sharing information)

Hi,

a co-worker and I had a diskussion today, if SEP mobile analyzes data which you sent via SSL e.g when you do online banking on the mobile device, before the data is encrypted. Any hint to that? Could not find any information to that.

↧

How to reset Symantec Endpoint Protection Manager password

October 25, 2019, 7:43 am

≫ Next: Missing Definition Folders

≪ Previous: SEP Mobile and SSL connections

I do not need a solution (just sharing information)

Dear all;

We are not reach Symantec Endpoint Protection Manager we forgot username and password. I have already research for a long time and I don't got it. There is nowhere Resetpass.bat files and I don't have a backup files.

Please help us.

symantec_8.png

↧

Missing Definition Folders

October 25, 2019, 11:58 am

≫ Next: SEP 14.1-14-2 cannot conect to console

≪ Previous: How to reset Symantec Endpoint Protection Manager password

I need a solution

Got a SEP client (14.0.3752.1000) on a 2012 server that's got problems. Ran CleanWipe and reinstalled. No joy. SymDiag shows a bunch of definition sets as corrupted. Each one says "No usage definition directory found".

Looking at the definitions folder, I'm only seeing the following:
AdvMLDefs
BASHDefs
EfaVTDefs
IronRevocationDefs
IronSettingsDefs
IronWhitelistDefs
SDSDefs
SRTSPSettingsDefs
STICDefs
VirusDefs

Other servers show more. Any suggestions?

↧

SEP 14.1-14-2 cannot conect to console

October 26, 2019, 3:44 am

≫ Next: Edge Chromium policy

≪ Previous: Missing Definition Folders

I need a solution

Hello -

I can`t connect to SEP manager. Web o Local.

Failed to connect to server

Make suer that the server is running and you session has not time out....

1. Full reinstall and update from 14.2.1031.0100 - 14.2.4815 . Restore during configure. din`t help

2. https://support.symantec.com/us/en/article.tech216... din`t help
i dont have

NT SERVICE\SepBridgeSrv
NT SERVICE\SepBridgeUploaderSrv

3. https://support.venafi.com/hc/en-us/articles/21857... din`t help

4. Edit %Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\conf.properties Conf.properties >> scm.db.datasource= jdbc/metadatabase din`t help

I have all servises running manage reset passwords and restart them.

1572204643

↧

Edge Chromium policy

October 27, 2019, 4:46 am

≫ Next: Device Control for SEPM

≪ Previous: SEP 14.1-14-2 cannot conect to console

I need a solution

Hello

In new Symantec Endpoint Protection cloud console I see there are default browser isolation policies for Firefox, IE, Chrome and Edge but not Edge Chromium. How can I get default policy for Edge Beta / Dev versions? It is hard to define every rule for it manually.

Best regards

↧