Incorrect revision for IPS, SONAR in computer status report

Products

• Endpoint Protection

Issue/Introduction

The Content Versions date is not matching on different pages in Symantec Endpoint Protection Manager (SEPM).
The inconsistency has been observed with the result found using "search client" and "computer status logs".  Content for SONAR/IPS/EDR and other component may be affected.

Environment

Cause

The SEM_CONTENT table contains all the LU content versions for the SEP clients. If a client upgrades itself, it could cause the table contains multiple entries which point to the same LU content type but different client monikers.
SEPM reports the LU content version for a client based on its LU content type, it could cause the query return incorrect version since the query always treats the last entry of the query return as the version.

Resolution

This issue is fixed in SEPM 14.3 RU9 release.

As a workaround, run the following query on SEPM database to remove all the entries with the old client monikers/clean up the SEM_CONTENT table:

UPDATE SC1
SET DELETED = 1
FROM 
                SEM_CONTENT SC1 WITH (NOLOCK)
                INNER JOIN PATTERN P1 WITH (NOLOCK) ON SC1.PATTERN_IDX = P1.PATTERN_IDX,
                SEM_CONTENT SC2 WITH (NOLOCK)
                INNER JOIN PATTERN P2 WITH (NOLOCK) ON SC2.PATTERN_IDX = P2.PATTERN_IDX
WHERE 
                P1.PATTERN_TYPE = P2.PATTERN_TYPE AND    -- modified here   
                SC1.AGENT_ID = SC2.AGENT_ID AND
                SC1.SEQUENCE < SC2.SEQUENCE AND
                SC1.DELETED = 0 AND
                SC2.DELETED = 0 AND
                P1.DELETED = 0 AND
                P2.DELETED = 0

If there are multiple sites, the query needs to be run on each database.