One or more enrolled SEP clients fail to send EAR activity events to SEDR

Products

• Endpoint Detection and Response
• Advanced Threat Protection Platform

Issue/Introduction

One or more enrolled Symantec Endpoint Protecton (SEP) clients fail to send Endpoint Activity Recorder (EAR) activity events to Symantec Endpoint Detection and Response (SEDR).

Resolution

On the Windows Explorer of the SEP client which does not send EAR events to SEDR, confirm free hard drive space on C:\ drive of the SEP client

Within SEDR UI, confirm the configured reserve space for EAR activities on the Data Recorder confiuration for the SEPM where the SEP client is managed.

If free hd space on the C:\ drive of the SEP client is less than the configured reserve space for EAR activities, remove unneeded files from C:\ or add free hd space by increasing capacity.