Endpoint Protection 14 RU1 client is receiving 469 Content Pending responses when performing a MakeGetAtpInfoFileUrl request

book

Article ID: 170588

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

When reviewing a sylink.log on an Symantec Endpoint Protection (SEP) 14 RU1 or newer client you notice certain requests are always returning 469 Content Pending responses.

11/30 07:23:54.073 [7388] <mfn_MakeGetAtpInfoFileUrl:>Request is: action=66&hostid=<removed>
11/30 07:23:54.073 [7388] </CSyLink::mfn_MakeGetAtpInfoFileUrl()>
11/30 07:23:54.073 [7388] <mfn_SendRequestToServer:><SEPM IP>:443/secars/secars.dll?<removed>
11/30 07:23:54.073 [7388] <InternetCallback> HttpOpenRequest; Internet status: 60; CtrlBlk: 0F52DB30
11/30 07:23:54.074 [7388] 7:23:54=>Send HTTP REQUEST
11/30 07:23:54.076 [6612] <InternetCallback> HttpSendRequest; Internet status: 100; CtrlBlk: 0F52DB30
11/30 07:23:54.095 [7388] AH: (InetWaiting) bFinished is TRUE on CtrlBlk: 0F52DB30
11/30 07:23:54.095 [7388] 7:23:54=>HTTP REQUEST sent
11/30 07:23:54.095 [7388] <mfn_SendRequestToServer:>SMS return=469
11/30 07:23:54.095 [7388] <ParseHTTPStatusCode:>469=>469 CONTENT PENDING
11/30 07:23:54.095 [7388] HTTP returns status code=469
11/30 07:23:54.095 [7388] <GetAtpInfoFileRequest:>RECEIVE STAGE COMPLETED
11/30 07:23:54.095 [7388] <GetAtpInfoFileRequest:>COMPLETED
11/30 07:23:54.095 [7388] </CSyLink::GetAtpInfoFileRequest()>
11/30 07:23:54.095 [7388] Failed to download the ATP information file from SEPM. Error: 4
11/30 07:23:54.095 [7388] <GetIndexFileRequest:>COMPLETED

Cause

Starting with SEP 14 RU1 the groundwork was laid to allow the SEP client to integrate with the new Endpoint Data Recorder feature present in ATP 3.0.  SEP 14 RU1 clients that are leveraging an ATP appliance will begin making this request to the Symantec Endpoint Protection Manager.  The MakeGetAtpInfoFileUrl request signifies the client requesting the login credentials for the ATP appliance in order to start forwarding its process events to ATP. 

Environment

SEP 14 RU1 or newer

Advanced Threat Protection (ATP) 2.3

Resolution

Update the ATP appliance to 3.0 so that this request can be completed.

If updating to ATP 3.0 is not possible these 469 Content Pending responses can be safely ignored as they do not interfere with any other content requests that the client will make.