External Logging is not working for risk log event

Products

Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection Manager (SEPM) is configured for external logging of risk log events. However, SEPM does not write risk log to agt_risk.tmp/agt_risk.log nor send log to syslog server. External Logging for other log types is working without issue.

<SEPM install folder>\tomcat\logs\scm-server-0.log :

2019-10-09 14:36:42.394 THREAD 97 Severe: in: com.sygate.scm.server.task.ExternalLoggingWorker

com.microsoft.sqlserver.jdbc.SQLServerException: Subquery returned more than one value. You can not return multiple values if the subquery comes before =,! =, <, <=,>,> =, Or if the subquery is used as a single expression.

at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(SQLServerException.java:262)

at com.microsoft.sqlserver.jdbc.SQLServerResultSet$FetchBuffer.nextRow(SQLServerResultSet.java:5427)

at com.microsoft.sqlserver.jdbc.SQLServerResultSet.fetchBufferNext(SQLServerResultSet.java:1758)

at com.microsoft.sqlserver.jdbc.SQLServerResultSet.next(SQLServerResultSet.java:1016)

at org.apache.tomcat.dbcp.dbcp.DelegatingResultSet.next(DelegatingResultSet.java:207)

at com.sygate.scm.server.task.ExternalLoggingWorker.handleLog(ExternalLoggingWorker.java:521)

at com.sygate.scm.server.task.ExternalLoggingWorker.run(ExternalLoggingWorker.java:372)

at java.util.TimerThread.mainLoop(Timer.java:555)

at java.util.TimerThread.run(Timer.java:505)

Environment

Symantec Endpoint Protection Manager
Symantec Endpoint Protection for Linux managed client

Resolution

This issue is fixed in Symantec Endpoint Protection 14.3. For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec Endpoint Protection.

Additional Information

ESCRT-1957