search cancel

AH02110: failed call to GetExtensionVersion() in C:/Program Files (x86)/Symantec/Symantec Endpoint Protection Manager/Inetpub/secars/secars.dll

book

Article ID: 161107

calendar_today

Updated On:

Products

Symantec Products

Issue/Introduction

Clients are failing to connect and the first three tabs of the Symantec Endpoint Protection Manager (SEPM) are blank.

Failed to connect to server error is displayed when logging into the SEPM and HTTPD.exe is repeatedly crashing in the Windows Event - Application log.

Error-Pacific Standard Time.log:

[Thu Sep 04 10:01:56.951466 2014] [isapi:error] [pid 7912:tid 2520] AH02110: failed call to GetExtensionVersion() in C:/Program Files (x86)/Symantec/Symantec Endpoint Protection Manager/Inetpub/secars/secars.dll
[Thu Sep 04 10:01:56.963466 2014] [mpm_winnt:notice] [pid 7912:tid 3228] Child 7912 Thread 7528: Starting thread to listen on port 8445.
[Thu Sep 04 10:01:58.670865 2014] [isapi:error] [pid 7912:tid 3224] (OS 5)Access is denied.  : AH02110: failed call to GetExtensionVersion() in C:/Program Files (x86)/Symantec/Symantec Endpoint Protection Manager/Inetpub/secreg/secreg.dll
[Thu Sep 04 10:01:58.862843 2014] [mpm_winnt:notice] [pid 5268:tid 472] AH00428: Parent: child process exited with status 255 -- Restarting.

SEPM UI shows an error: Failed to connect to server.

Windows Event - Application log:

Log Name:      Application
Source:        Application Error
Date:          9/4/2014 10:04:51 AM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Redacted
Description:
Faulting application name: httpd.exe, version: 2.4.6.153, time stamp: 0x539e89a7
Faulting module name: secars.dll_unloaded, version: 0.0.0.0, time stamp: 0x53fdaeef
Exception code: 0xc0000005
Fault offset: 0x6cbb4150
Faulting process id: 0x2114
Faulting application start time: 0x01cfc8625698f77e
Faulting application path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\bin\httpd.exe
Faulting module path: secars.dll
Report Id: 94d9321b-3455-11e4-943a-0024e847494c
Faulting package full name:
Faulting package-relative application ID:
 

Log Name:      Application
Source:        secars
Date:          9/4/2014 10:04:51 AM
Event ID:      4096
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Redacted
Description:
Initialize Server Configuration Error

Log Name:      Application
Source:        Windows Error Reporting
Date:          9/4/2014 10:04:51 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Redacted
Description:
Fault bucket , type 0
Event Name: BEX
Response: Not available
Cab Id: 0

Problem signature:
P1: httpd.exe
P2: 2.4.6.153
P3: 539e89a7
P4: secars.dll_unloaded
P5: 0.0.0.0
P6: 53fdaeef
P7: 6cbb4150
P8: c0000005
P9: 00000008
P10:

Scenario 2: SEPM console shows same error "Failed to connect to server" and below error in Windows Event Viewer

Date: 6/30/2022 1:40:09 PM
Log: Application
Event Type: Error
Source: Application Error
Computer: xxxxx.local
User:
Event ID: 1000
Description:
"Faulting application name: httpd.exe, version: 2.4.33.325, time stamp: 0x5ae97d1c
Faulting module name: secars.dll_unloaded, version: 14.2.758.0, time stamp: 0x5b1f196b
Exception code: 0xc0000005
Fault offset: 0x00034d00
Faulting process id: 0x3c1c
Faulting application start time: 0x01d88c43db82b954
Faulting application path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\bin\httpd.exe
Faulting module path: secars.dll
Report Id: b6751014-557e-4860-a7c6-cd214f8ef133
Faulting package full name: 
Faulting package-relative application ID:"
Details:

Below error is repeated in apache error logs (C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\logs\error.log) 

[Wed Jun 22 08:49:17.993700 2022] [isapi:error] [pid 4236:tid 584] AH02110: failed call to GetExtensionVersion() in C:/Program Files (x86)/Symantec/Symantec Endpoint Protection Manager/Inetpub/secars/secars.dll
[Wed Jun 22 08:49:17.993700 2022] [isapi:error] [pid 4236:tid 584] AH02110: failed call to GetExtensionVersion() in C:/Program Files (x86)/Symantec/Symantec Endpoint Protection Manager/Inetpub/secreg/secreg.dll

Cause

The issue is caused by copying conf.properties out of the %SEPM_install_directory%\tomcat\etc folder and then replacing the original conf.properties file with the copied one. The semwebsrv account will not have read access rights on the copied conf.properties, because the copied one inherits permissions from its parent folder, which only provides List folder / read data access. This results in semwebsrv being unable to read conf.properties.

Resolution

Change the Security options (i.e., permissions) for conf.properties to provide the semwebsrv account with the following permissions: Read

How to give semwebsrv Read permissions on conf.properties:

  1. Right-click conf.properties
  2. Click Properties
  3. Click the Security tab
  4. Click Edit...
  5. Select semwebsrv under Group or user names:
  6. Check the checkbox for Allow on the Read permission under Permissions for semwebsrv
  7. Click Apply
  8. Click OK
  9. Restart the Symantec Endpoint Protection Manager Webserver service

In scenario 2, the 'conf.properties' itself was corrupted (0 KB in size). scm-server-0.log was not showing any new entries, an older file (scm-server-2.log) has the below error:

2022-06-21 11:03:52.059 THREAD 40 SEVERE: Disk space below critical, Updating server health
2022-06-21 11:03:52.184 THREAD 40 SEVERE: Stop ClientTransport.
2022-06-21 11:03:52.184 THREAD 40 SEVERE: There is not enough disk space, Stopping Client Transportion.

Restoring a backup of 'conf.properties' file and restarting the service fixed the issue.

Powered by Wolken Software