SONAR out of date definitions report from a SEPM shows incorrect information.

Products

• Endpoint Protection

Issue/Introduction

The Symantec Endpoint Protection Manager (SEPM) administrators receive email alerts for out of date SONAR content on machines. The report shows a large number of clients that are out of date. There are multiple dilemmas here as the out of date numbers from the SEPM home page chart does not match, and when checking the actual clients and the client properties within the SEPM console, the clients do have up to date SONAR content.

Environment

SEPM and SEP client versions are 14.3 RU6

Cause

A client with an out-of-date 14.3 RU4 SONAR content but with the latest RU6 content in SEM_CONTENT table is causing to trigger the SONAR Out-of-date notification on this client. When the report query is run, the query was not taking into consideration a specific scenario with the content tables. 

Resolution

Issue fixed in Endpoint Protection Manager 14.3 RU8 version.