Unexpected exception event "USN invalid"

Products

• Endpoint Protection

Issue/Introduction

There are repeated events received on Symantec Endpoint Protection Manager (SEPM) as follows:
Event Type: An unexpected exception has occurred
Event description: USN invalid

Below errors are seen scm-server logs:

 

In 2025-11-07 04:05:40.585 THREAD 41319 SEVERE: USN invalid in: com.sygate.scm.server.task.AgentLogCollector$ExecutorTask

com.sygate.scm.server.util.ServerException: USN invalid.

at com.sygate.scm.server.util.USNWasher.washUSN(USNWasher.java:138)

at com.sygate.scm.server.logreader.sep.LogHandler.process(LogHandler.java:97)

at com.sygate.scm.server.task.AgentLogCollector$ExecutorTask.run(AgentLogCollector.java:427)

at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)

at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)

at java.base/java.lang.Thread.run(Thread.java:829)

 

2025-10-14 13:12:53.576 THREAD 32 Warning: Session ID NOT found hence returning...

2025-10-14 13:17:30.597 THREAD 17663 SEVERE:  in: com.sygate.scm.server.logreader.sep.BatchLogHandler

java.sql.SQLException: Invalid data for the specified data type. Column Index: 2, type=-5, value: %$$SY&~USN$$%

at com.sygate.scm.server.db.util.DatabaseUtilities.setUpPreparedStatementForOneColumn(DatabaseUtilities.java:2122)

at com.sygate.scm.server.db.util.DatabaseUtilities.setUpPreparedStatement(DatabaseUtilities.java:1924)

at com.sygate.scm.server.logreader.sep.BatchLogHandler.process(BatchLogHandler.java:233)

at com.sygate.scm.server.logreader.sep.LogHandler.process(LogHandler.java:141)

at com.sygate.scm.server.task.AgentLogCollector$ExecutorTask.run(AgentLogCollector.java:427)

at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)

at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)

at java.base/java.lang.Thread.run(Thread.java:829)

Cause

• It could be an issue with the resources in the machine and SEPM is affected when trying to execute USNWash.exe. This is an environmental issue.
• If the temporary or cache files are taking up hard disk space, it can also affect processing any command.

Resolution

Clear all the temporary/cached files from temp folder (%temp%) and below SEPM install directories:
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\inbox\log\behavior
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\inbox\log\client
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\inbox\log\security
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\inbox\log\system
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\inbox\log\traffic