Endpoint Protection

  • Private Community
 View Only

  • 1.  IIS crashing after inplace upgrade of SEPM 11.6 to 12.1

    Posted Jul 24, 2011 05:20 PM

    We have recently carried out an in-place upgrade of SEPM from v11.6 to 12.1 on a Windows Server 2003 SP2 box and are experiencing problems.

    All SEP clients would suddenly report the SEPM server as being 'offline'. After logging onto the SEPM it showed all clients as being offline.

    On checking the system event log there were multiple Http and W3SVC errors (see below).

    The OS would disable the application pool in IIS 'DefaultAppPool' and on doing so clients would report the server as being offline and vice versa. On manually restarting the 'DefaultAppPool' in IIS server / client comms were restored temporarily until the 'DefaultAppPool' was again disabled due to multiple W3 comms errors.

    I understand SEPM12.1 no longer uses IIS but Tomcat? Is this correct and if so during the upgrade from 11.x to 12.x has IIS not been 'cleaned up' correclty during the conversion process?

    The server is also running Symantec Backup Exec 2008 R2.

    Event Type: Warning
    Event Source: HTTP
    Event Category: None
    Event ID: 54
    Date:  25/07/2011
    Time:  8:48:35 a.m.
    User:  N/A
    Computer: SKIWI-BACKUP
    Description:
    The description for Event ID ( 54 ) in Source ( HTTP ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: \Device\Http\AppPool.
    Data:
    0000: 00 00 00 00 01 00 52 00   ......R.
    0008: 00 00 00 00 36 00 04 80   ....6..€
    0010: 00 00 00 00 00 00 00 00   ........
    0018: 00 00 00 00 00 00 00 00   ........
    0020: 00 00 00 00 00 00 00 00   ........
     

    Event Type: Warning
    Event Source: W3SVC
    Event Category: None
    Event ID: 1011
    Date:  25/07/2011
    Time:  8:50:01 a.m.
    User:  N/A
    Computer: SKIWI-BACKUP
    Description:
    A process serving application pool 'DefaultAppPool' suffered a fatal communication error with the World Wide Web Publishing Service. The process id was '7744'. The data field contains the error number.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 6d 00 07 80               m..€   

    Event Type: Error
    Event Source: W3SVC
    Event Category: None
    Event ID: 1002
    Date:  25/07/2011
    Time:  8:50:01 a.m.
    User:  N/A
    Computer: SKIWI-BACKUP
    Description:
    Application pool 'DefaultAppPool' is being automatically disabled due to a series of failures in the process(es) serving that application pool.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

     



  • 2.  RE: IIS crashing after inplace upgrade of SEPM 11.6 to 12.1

    Posted Jul 25, 2011 01:00 AM

    Yes; it uses tomcat!!

    may be the upgrade was corrupted



  • 3.  RE: IIS crashing after inplace upgrade of SEPM 11.6 to 12.1

    Posted Jul 25, 2011 01:46 AM

    You can try to restore the database to 11.6 first....and take it from there...did you ugrade to 12.1 SMB, 0r 12.1 Enterprise edition?



  • 4.  RE: IIS crashing after inplace upgrade of SEPM 11.6 to 12.1

    Posted Jul 25, 2011 02:53 AM

    is the SEPM services started? if yes, then run sylink log from client and check for the error details for not communicating to SEPM.



  • 5.  RE: IIS crashing after inplace upgrade of SEPM 11.6 to 12.1

    Broadcom Employee
    Posted Jul 25, 2011 06:02 AM

    Hi,

    Check following articles

    Upgrading and migrating to Symantec Endpoint Protection 12.1
     
    http://www.symantec.com/docs/TECH163602
     
    Planning for Migration to Symantec Endpoint Protection Manager 12.1
     
    http://www.symantec.com/docs/TECH162730
     
    Symantec Endpoint Protection Manager 12.1 Communication Troubleshooting
     
    http://www.symantec.com/docs/TECH160964 
     
    How to bypass the IIS proxy after upgrading to Symantec Endpoint Protection Manager 12.1
     
    http://www.symantec.com/docs/TECH162324 


  • 6.  RE: IIS crashing after inplace upgrade of SEPM 11.6 to 12.1

    Posted Jul 25, 2011 05:21 PM

    Hi there,

    We upgraded to 12.1 enterprise. The SEPM service is running.

    I will revert to 11.6 and restore the DB if I can't resolve the issue.

    I have tried repairing the SEPM installation and removing and reinstalling IIS. Still no joy. The W3 errors stopped however after removing / reinstalling IIS. However now no clients are reporting the the SEPM server.

    Have captured sylink logs and used the SEP support tool to capture SEPM server info and sent to Symantec Support. Sylink logs only identify that there is a comms error and the SEPM server is offline, nothing specific.

    Any other tips appreciated.

     

     

     

     

     



  • 7.  RE: IIS crashing after inplace upgrade of SEPM 11.6 to 12.1

    Posted Jul 26, 2011 01:10 AM

    Hi,

      Check this , it might because of IIS proxy .

    Bypass the IIS proxy and try it.

    check the link for bypassing the IIS proxy ,

    http://www.symantec.com/docs/TECH162324



  • 8.  RE: IIS crashing after inplace upgrade of SEPM 11.6 to 12.1

    Broadcom Employee
    Posted Jul 26, 2011 03:43 AM

    Hi,

    I believe this thread might help you to restore your clients communication.

    https://www-secure.symantec.com/connect/forums/migration-sepm-ru7-unsupported



  • 9.  RE: IIS crashing after inplace upgrade of SEPM 11.6 to 12.1

    Posted Jul 26, 2011 06:50 AM

     

    Good evening we have the same issue too. I have a case open. I have just been told to reinstall 11.6 client as unmanaged for now until a fix is found. We also had issues with the “ccsvchst.exe” process not ending when running in Terminal application mode