Scheduled scan logs are not sent to Symantec Endpoint Protection Manager (SEPM) from Linux Symantec Endpoint Protection (SEP) clients. These logs are visible on the client side AV logs.
cafagent.log will show PostingFailed events
[|] 2022-08-11 05:56:34 | cvehandler.CommunicationContext | Debug | 3894 : 140189186516736 : LogUploadStatusCB:211 | LogUploadStatus callback status= 0 Application log uploaded = 0
[|] 2022-08-11 05:56:34 | cvehandler.ClientLogProvider | Debug | 3894 : 140189186516736 : PostingFailed:108 | Log PostingFailed for id= (Customer ID number)
[|] 2022-08-11 05:56:34 | cvehandler.LogsPacker | Debug | 3894 : 140189186516736 : PostUpload:1190 | result of upload: 0
[|] 2022-08-11 05:56:34 | cvehandler.LogsPacker | Debug | 3894 : 140189186516736 : PostUpload:437 | SysLogPacker::PostUpload()
[|] 2022-08-11 05:56:34 | cvehandler.LogsPacker | Debug | 3894 : 140189186516736 : IsEnabled:313 | SysLogPacker::Init()
[|] 2022-08-11 05:56:34 | cvehandler.LogsPacker | Debug | 3894 : 140189186516736 : PostUpload:890 | ExtLogPacker::PostUpload()
[|] 2022-08-11 05:56:34 | cvehandler.CommunicationContext | Debug | 3894 : 140189186516736 : StatusCB:180 | Client Status connected:0 state:2 lastServer: lastTime:
[|] 2022-08-11 05:56:34 | cvehandler.ClientManager | Debug | 3894 : 140189186516736 : UpdateConnectionStatus:186 | Connection State with SEPM: 1, HB State :2
[|] 2022-08-11 05:56:34 | cvehandler.CommunicationContext | Debug | 3894 : 140189186516736 : StatusCB:194 | Updated connection status successfully
[|] 2022-08-11 05:56:34 | cvehandler.CommunicationContext | Debug | 3894 : 140189186516736 : StatusCB:180 | Client Status connected:0 state:1 lastServer: <sepmip> lastTime: 2022-08-11T05:56:34.855387Z
[|] 2022-08-11 05:56:34 | cvehandler.ClientManager | Debug | 3894 : 140189186516736 : UpdateConnectionStatus:186 | Connection State with SEPM: 1, HB State :1
SEP 14.3x Linux agent
Issue is observed if connectivity between SEPM and Agent is lost or not available while sending scan result data.
We have implemented retry logic with new code which will attempt to resend the scan result if it fails in the first attempt.
The issue is fixed and available in SEP for Linux 14.3 RU6.