Symantec Endpoint Protection Server 12.1.x

Version 1

    This template allows you to monitor Symantec Endpoint Protection Server 12.1.x services and major TCP ports.

     

    Prerequisites: WMI access to target server.

    Credentials: Administrator on target server.


    Monitored Components

    Service: Symantec Embedded Database

    This monitor returns the CPU and memory usage of the Symantec Embedded Database service. This service is responsible for the embedded database used by the Symantec Endpoint Protection Manager.

     

    Service: Symantec Endpoint Protection Manager

    This monitor returns the CPU and memory usage of the Symantec Endpoint Protection Manager service. This service is responsible for the application server which communicates with the Symantec Endpoint Protection Manager, Symantec Protection clients, and database.

     

    Service: Symantec Endpoint Protection Manager Webserver

    This monitor returns the CPU and memory usage of the Symantec Endpoint Protection Manager Webserver service. This service allows you to communicate with the SEPM manager using a web interface.

     

    TCP Port: Server

    This component monitor tests the ability of a Symantec SEP Server to accept incoming sessions. This port is used in HTTPS communication between a remote management console and the Symantec Endpoint Protection Manager. All login information and administrative communication takes place using this secure port. By default it monitors TCP port 8443.

     

    TCP Port: Web Console

    This component monitor tests the ability of a Symantec Web Console to accept incoming sessions. This port is used in initial HTTP communication between a remote management console and the Symantec Endpoint Protection Manager (to display the login screen only). By default it monitors TCP port 9090.

     

    TCP Port: Client Communication

    This component monitor tests the ability of a Symantec Server to accept information from clients. This port is used in communication between the Symantec Endpoint Protection Manager and Symantec Endpoint Protection clients and Enforcers. By default it monitors TCP port 8014.

     

    TCP Port: Protection Web Center

    This component monitor tests the ability of a Protection Web Center to accept incoming sessions. SPC 2.x makes Data Feed and Workflow requests to Symantec Endpoint Protection Manager over this port. By default it monitors TCP port 8444.

     

    TCP Port: Reporting

    This component monitor tests the ability of a HTTPS reporting console to accept incoming sessions. By default it monitors TCP port 8445.

     

    Warning and Error Events: Symantec Network Protection

    This monitor returns warning and error events for Symantec Network Protection source name in application log file.

     

    Configuring Windows Remote Management (WinRM)

    1. If not already done so, install PowerShell 2.0 and WinRM on the SAM and target servers. Powershell 2.0 can be found here: http://support.microsoft.com/kb/968930.
    2. On the APM server, open a command prompt as an Administrator. To do this, perform the following step:
    • Go to the Start menu and right-click the cmd.exe and then select Run as Administrator.
    1. Enter the following in the command prompt:
             winrm quickconfig
      winrm set winrm/config/client @{TrustedHosts="*"}
    2. 4.     On the target server, open a command prompt as an Administrator and enter the following:
             winrm quickconfig
      winrm set winrm/config/client @{TrustedHosts="IP_ADDRESS"}

    where IP address is the IP address of your SAM server.

     

    Copyright 2014. Portions of this template is based on the following:
    http://www.symantec.com/business/support/index?page=content&id=TECH163787
    http://www.symantec.com/business/support/index?page=content&id=TECH186925
    http://www.symantec.com/business/support/index?page=content&pmv=print&impressions=&viewlocale=&id=HOWTO75109

    Last updated: 9/29/2014