After upgrading from Protection Engine for Cloud 8.2.1 to version 9.x the Symantec Protection Engine Controller service will not remain started. It will quickly abort on error 1053.
The abort log, "SymantecProtectionEngineControllerAbortLog.txt" contained the following reasons:
Symantec Protection Engine Controller is shutting down; logs may contain more information : VirtualHome definitions mode is disabled.
URL Filtering should not be enabled in VirtualHome definitions mode. Turning off VirtualHome definitions mode..
In Symantec Protection Engine (SPE) version 9.2, the controller process has been deprecated. Users should not attempt to start this service, as its functionality has now been integrated into the SPE service.
Controller Process Disabled:
Definitions Update:
URL Insight Feature:
The integration of the controller process functionality into the SPE service simplifies the management of SPE, ensuring that necessary updates and operations continue.
Release : 9.0.1
1. The file configuration.xml was corrupted or had invalid characters in it due to being edited directly.
There were multiple entries in configuration.xml for "<CloudName value="none"/>" where there should only be one. This caused the upgrade to double/triple the JavaLocation and other sections. This section directly preceded the "VirtualHome" setting. It is believed the duplicate sections made it difficult to parse the xml file for the correct information.
Example:
<CloudName value="none"/>
<CloudName value="none"/>
<CloudName value="none"/>
2. As per the error message, URL filtering is enabled and should not be in the current configuration.
NOTE: Occasionally licenses have been released containing the as section similar to the following--which renders the URL Reputation Filtering portion of the license invalid. The license should be reissued by a Sales Representative.
If the URL Filtering license is rendered invalid, and URL Filtering is enabled then this will cause the Controller service to abort.
The controller process is deprecated in 9.2. Please do not try to start this service. The functionality of controller service is now moved to SPE service.
In 9.2 we have disabled the controller process. Let it be disabled. You should not worry about it as their defs update will happen anyway.
The reason behind that is There is a feature called URL insight. Which is part of AV scan (scans URLs within the file). The URL db download does not support Virtual Home due to which we have removed this feature.
For Cause 1. There is no xmlmodifier command that will remove duplicate sections. Manual editing of the file will be required.
For Cause 2. Disable the URL filtering features.
Linux:
./xmlmodifier -s //filtering/URLFilter/@enabled false filtering.xml
./xmlmodifier -s //filtering/URLReputation/@enabled false filtering.xml
./symcscan.sh restart
./controller.sh start
./controller.sh status
Windows:
xmlmodifier -s //filtering/URLFilter/@enabled false filtering.xml
xmlmodifier -s //filtering/URLReputation/@enabled false filtering.xml
net stop symcscan && net start symcscan
{or go to the Services panel and restart Symantec Protection Engine service and verify that the controller service started also}