Endpoint Protection

  • Private Community
 View Only

  • 1.  Errors (Event 7301) on a Server

    Posted Jan 18, 2011 04:29 AM

    Hi,

    We've started gettings a load of Event ID: 7031 Service Control Manager Errors.

    The Symantec Endpoint Protection service terminated unexpectedly. IT has done this xx time(s). The following corrective action will be taken in 10000 milliseconds: Restart the Service.

    This goes on and on, when the server is rebooted the counter is reset.

    Any ideas/known causes of this - I can't see any other service hanging/stopping/acting oddly on the server.

    Running RU6 MP2

    Cheers,

    Mike



  • 2.  RE: Errors (Event 7301) on a Server

    Posted Jan 18, 2011 04:52 AM

    Try by reinstalling SEP client.Also delete associated folders before installing SEP back...



  • 3.  RE: Errors (Event 7301) on a Server

    Posted Jan 18, 2011 05:06 AM

    this will happen if some process is trying to stop symantec services.

    do you have tamper protection enabled?

    check the tamper protection logs to see who is fighting with symantec, if its legitimate, create an exclusion for it...



  • 4.  RE: Errors (Event 7301) on a Server

    Posted Jan 18, 2011 05:18 AM

    Aravind,

     

    Unfortunately this is a production server so won't be able to remove/re-install at the moment.



  • 5.  RE: Errors (Event 7301) on a Server

    Posted Jan 18, 2011 05:24 AM

    Rafeeq,

     

    I believe tamper protection is enabled, but the log is showing empty.



  • 6.  RE: Errors (Event 7301) on a Server

    Posted Jan 18, 2011 05:29 AM

    have u checked the option to pop up the msg?

    open task manager, try to kill any symantec service does it say anything?

    if not then the smc service itself is stopped, do a quick start and check the log,u should be able to find somethign.



  • 7.  RE: Errors (Event 7301) on a Server

    Posted Jan 18, 2011 05:37 AM

    Stange, it's set to log & display a message - however killing smcgui produces to message, but the service restarts and task tray icon reappears...

     

    If I try to terminate SMC or rtvscan it states access is denied - nothing appears in the logs though.



  • 8.  RE: Errors (Event 7301) on a Server

    Posted Jan 18, 2011 05:51 AM

    hmmm ! so tamper protection is working , try to do a repair from add/remove programs, how often do u get this event ID? 



  • 9.  RE: Errors (Event 7301) on a Server

    Posted Jan 18, 2011 09:37 AM

    That's the thing... some times it does it 20 times in a hour and other times 2 times in 6 hours, no obvious consistancy - i've performed the repair as suggested and will monitor the results.



  • 10.  RE: Errors (Event 7301) on a Server

    Posted Jan 19, 2011 03:57 AM

    Still not fixed it....

     

    Got the same message at  7:30pm, 8:48. 9:12, 9:29 etc last night and a further 12 this morning - I think maybe i'll try a cleanwipe and re-install.