Home, Monitors, and Reports are blank due to php.ini misconfiguration
search cancel

Home, Monitors, and Reports are blank due to php.ini misconfiguration

book

Article ID: 164916

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

While logging into the Symantec Endpoint Protection Manager (SEPM), you receive "Unexpected server error."

The login works, then shows an error on Home page as below:
Unexpected Error
Internal server error.

Following errors are observed in different scenarios:

Scenario 1

scm-server-0.log:

2017-03-22 11:10:26.039 SEVERE:  in: com.sygate.scm.server.task.ScheduledReportingTask
java.io.IOException: Server returned HTTP response code: 500 for URL: https://SEPM:8445/Reporting/reports/sr-login.php
    at sun.reflect.GeneratedConstructorAccessor36.newInstance(Unknown Source)

reporting.log:

[22-Mar-2017 15:11:25 UTC] PHP Warning:  require(Include/resources/reporter.php): failed to open stream: No such file or directory in D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\Reporting\Reports\sr-login.php on line 19
[22-Mar-2017 15:11:25 UTC] PHP Fatal error:  require(): Failed opening required 'Include/resources/reporter.php' (include_path='.') in D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\Reporting\Reports\sr-login.php on line 19

scm-ui.err:

Mar 21, 2017 3:58:06 PM  STDERR: com.sygate.scm.console.util.ConsoleException: You are no longer connected to the Symantec Endpoint Protection Manager. You must log on again to continue. [0x11010000]

Scenario 2

scm-server-0.log:

2025-11-27 15:41:02.976 THREAD 66 SEVERE:  in: com.sygate.scm.server.task.ScheduledReportingTask
java.io.IOException: Server returned HTTP response code: 500 for URL: https://SEPM:8445/Reporting/Reports/switcher.php?MyFavoriteReport=R-17-Default
at java.base/jdk.internal.reflect.GeneratedConstructorAccessor37.newInstance(Unknown Source)
 
scm-ui log:

27 Nov, 2025 3:40:47 PM  STDOUT: Browser: Thread[JavaFX Application Thread] location changed! new location: https://SEPM:8445/Reporting/dashboard/homepage.php
27 Nov, 2025 3:40:47 PM  STDOUT: Browser> jbInit>>: Thread[JavaFX Application Thread], newState = SCHEDULED
27 Nov, 2025 3:40:47 PM  STDOUT: Browser> jbInit>>: Thread[JavaFX Application Thread], newState = RUNNING
27 Nov, 2025 3:40:47 PM  STDOUT: Browser> jbInit>>: Thread[JavaFX Application Thread], webEngine.titleProperty() changed! newValue: Unexpected Error
27 Nov, 2025 4:19:19 PM LoggerUtilities STDERR: Exception:
com.sygate.scm.console.util.ConsoleException: The administrator's user name or password is incorrect. Type a valid user name or password. [0x14010000]
at com.sygate.scm.console.util.GUIManager.verifyLoginResponseObject(GUIManager.java:3298)

27 Nov, 2025 4:19:24 PM GUIManagerReportingHelper SEVERE: Reporting error on login!
27 Nov, 2025 4:19:24 PM GUIManagerReportingHelper SEVERE: Unexpected server error. ErrorCode: 0x10010000
27 Nov, 2025 4:19:24 PM ExceptionHandler SEVERE: Root cause of the exception: HTTP 500 Internal Server Error, URL: https://SEPM:8445/Reporting/Login/sr-login.php
27 Nov, 2025 4:19:24 PM GUIManagerReportingHelper INFO: Reporting login done!
 
Apache error (C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\logs\error.log):
[Thu Nov 27 16:23:02.488667 2025] [fcgid:warn] [pid 9568:tid 5584] (OS 109)The pipe has been ended.  : [client IP:53801] mod_fcgid: get overlap result error
[Thu Nov 27 16:23:02.488667 2025] [core:error] [pid 9568:tid 5584] [client IP:53801] End of script output before headers: sr-login.php
[Thu Nov 27 16:23:02.623658 2025] [fcgid:warn] [pid 9568:tid 5584] (OS 109)The pipe has been ended.  : [client IP:53802] mod_fcgid: get overlap result error
[Thu Nov 27 16:23:02.623658 2025] [core:error] [pid 9568:tid 5584] [client IP:53802] End of script output before headers: switcher.php
 
Running the below command to test if the php.ini file can be loaded using command prompt with admin rights from C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Php:
php --ini

PHP Warning:  'C:\Windows\System32\vcruntime140.dll' 14.0 is not compatible with this PHP build liked with 14.29 in Unknown on line 0

Cause

In scenario 1, the SEPM cannot find reporter.php and fails to load the page.
The location of reporter.php is defined in php.ini file (Default Path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Php\Php.ini)
On examining the php.ini file, found that the include_path is incorrect. (It is missing the quotes for the path)

include_path=. ;C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\Reporting;D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Php

In scenario 2, the issue was found due to an older version of vcruntime140.dll in "C:\Windows\SysWOW64\".
It may be modified by some other application that also uses Microsoft Visual C++ Redistributable.

Resolution

For scenario 1:
Modify include_path in php.ini to add quotes in the path:
include_path=". ;D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\Reporting;D:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Php"

Scenario 2:

  • Stop all SEPM services.
  • Back up and delete vcruntime140.dll from C:\Windows\SysWOW64\.
  • Run vcredist_x84.exe from SEPM installer and verify that the .dll is created again under SysWOW64.
    If there is an error during install (something like; already installed version is more higher than the installer version), need to uninstall the existing version/s of Microsoft Visual C++ Redistributable from Control Panel\All Control Panel Items\Programs and Features
  • Restart the SEPM services
Powered by Wolken Software