The Symantec Endpoint Protection Manager displays an error which reads "Datastore error"

book

Article ID: 156455

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

The Admin > Servers page within the Symantec Endpoint Protection Manager (SEPM) 12.1 displays an error which reads "Datastore error" on a regular basis.  AV logs from some SEP clients may not be displayed in SEPM risk reports.

The timestamps of the errors in the SEPM correspond to errors in scm-server-0.log similar to the following:

 2012-05-09 14:50:09.187 THREAD 39 SEVERE: Datastore error in: com.sygate.scm.server.task.AgentAVLogCollector
java.lang.ArrayIndexOutOfBoundsException: 14
at com.sygate.scm.server.logreader.av.ParseSecurityRecord.parseNativeLogRecord(ParseSecurityRecord.java:435)
at com.sygate.scm.server.logreader.av.ParseSecurityRecord.parseSEPLogRecord(ParseSecurityRecord.java:262)
at com.sygate.scm.server.logreader.av.LogHandler.parseSEPLog(LogHandler.java:173)
at com.sygate.scm.server.logreader.av.LogHandler.process(LogHandler.java:109)
at com.sygate.scm.server.task.AgentLogCollector.enumerateInbox(AgentLogCollector.java:255)
at com.sygate.scm.server.task.AgentAVLogCollector.collectLogs(AgentAVLogCollector.java:33)
at com.sygate.scm.server.task.AgentLogCollector.execute(AgentLogCollector.java:86)
at com.sygate.scm.server.task.MonitoredTimerTask.run(MonitoredTimerTask.java:22)
at java.util.TimerThread.mainLoop(Timer.java:512)
at java.util.TimerThread.run(Timer.java:462)
com.sygate.scm.server.util.ServerException: Datastore error
at com.sygate.scm.server.logreader.av.LogHandler.process(LogHandler.java:142)
at com.sygate.scm.server.task.AgentLogCollector.enumerateInbox(AgentLogCollector.java:255)
at com.sygate.scm.server.task.AgentAVLogCollector.collectLogs(AgentAVLogCollector.java:33)
at com.sygate.scm.server.task.AgentLogCollector.execute(AgentLogCollector.java:86)
at com.sygate.scm.server.task.MonitoredTimerTask.run(MonitoredTimerTask.java:22)
at java.util.TimerThread.mainLoop(Timer.java:512)
at java.util.TimerThread.run(Timer.java:462)

Cause

One or more Symantec Endpoint Protection clients is forwarding invalid logs to the SEPM. The SEPM is unable to process the invalid logs which generates the "Datastore error" error messages.

Resolution

This issue has been fixed in Symantec Endpoint Protection 12 Release Update 2 (RU2).  For information on how to obtain the latest build of Symantec Endpoint Protection, read TECH 103088: Obtaining an upgrade or update for Symantec Endpoint Protection or Symantec Network Access Control.