Backup Exec Snapshot Exceptions Symantec Endpoint Protection

[techuser]

I am running the latest release of Backup Exec 2010 R3, and just upgraded to the latest release of Symantec Endpoint Protection V12. Over the weekend, after upgrading to the latest release of Symantec Endpoint Protection V12, I got several errors' on my backups.

Backup- \\SERVERNAME\C:
Unable to open the item \\SERVERNAME\C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVer...
Unable to open the item \\SERVERNAME\C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVer...

Backup- \\SERVERNAME\System?State
VSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eectrl64.sys ...

Backup- \\SERVERNAME\C:
Unable to open the item \\SERVERNAME\C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVer...
Unable to open the item \\SERVERNAME\C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVer...

Backup- \\SERVERNAME\System?State
VSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eectrl64.sys ...

Backup- \\SERVERNAME\System?State
VSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eectrl64.sys ...

It appears that the latest version of Symantec Endpoint Protection 12 and Backup Exec 2010 R3 do not play well together? I researched this error message and supposedly it indicates that the files are not present, but that there are registry entries. How do I correct this so that there are no longer exemptions to the Backup Exec 2010 R3 jobs.

[AmolB]

If there are limited number of files appearing in the exception then as a work around create dummy text 

files with the same name at the same location.

[techuser]

I found that for this one error...

Backup- \\SERVERNAME\System?State
VSS Snapshot warning. File c:\program files (x86)\common files\symantec shared\eengine\eectrl64.sys is not present on the snapshot.

A registry Key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eeCtrl\

However, there are multiple files named with eectrl64.sys. I can change the registry key ImagePath to point to the correct location, however I am unsure of the exact path that it should be point too.

I found about 8 different locations of this file on the system.

"C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\content\{Long Number}\110717002\Full\EECTRL64.SYS"

"C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\content\{LongNumber}\110716003\Full\EECTRL64.SYS"

"C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\content\{LongNumber}\110715025\Full\EECTRL64.SYS"

"C:\ProgramData\Symantec\Definitions\VirusDefs\20110714.005\EECTRL64.SYS"

"C:\ProgramData\Symantec\Definitions\VirusDefs\20110714.022\EECTRL64.SYS"

"C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.671.4971.105\Data\Definitions\VirusDefs\20110717.002\EECTRL64.SYS"

"C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Definitions\VirusDefs\20110717.002\EECTRL64.SYS"

"C:\ProgramData\Symantec\Definitions\SymcData\spcVirDef64\20110717.002\EECTRL64.SYS"

"C:\ProgramData\Symantec\Definitions\SymcData\spcVirDef64\BinHub\EECTRL64.SYS"

"C:\ProgramData\Symantec\Definitions\VirusDefs\20110713.037\EECTRL64.SYS"

"C:\ProgramData\Symantec\Definitions\VirusDefs\BinHub\eeCtrl64.sys"

I am concerned that if I just use dummie text files that everytime an update occurs on Endpoint Protection the Snapshots will report this warning.

[AmolB]

Since there are so many files in the exception the work around will not help.

Have you tried repair install of SEP.

[techuser]

I have searched the registry for the _RDRPluginG and _SNDPluginG files and do not see any registry entries. If there are no registry entries then it should not be locking the files?

The files appear to be in the directory, but the properties are showing as being hidden.

[RahulG]

1) Search for the problem file  on the machine.

2) If the file(s) are present, copy the file(s) to the location referenced in the Backup Exec job log as not present.If you find many instances of the file then probably you can use any one of them check if the size of all the file is same or probaly contact SEP support to find the correct file which should be at that location or do you really need to backup those files or exclude them from backups

3) If the files are not present, download the latest SEP software or use the CD that came up with SEP and manually extract the files to the path referenced in the job log. If the path mentioned in the job log does not exist, manually create the path.

refer http://www.symantec.com/business/support/index?page=content&id=TECH75487

http://www.symantec.com/business/support/index?page=content&id=TECH135515

[Shaun_Crandall]

Did anyone have a solution for this issue?  We are experiencing the same problem.  I can locate the files in the specified location but they are in use and are in 0KB in size.

[techuser]

I spoke to Symantec Endpoint Protection and Symantec Backup Exec backline support, and was advised to create an exception in Backup Exec to ignore the Endpoint Protection files. I was also advised that creation of dummie files can also work in these circumstances.

I did express my concern that should I ever have to do a restore that the restoration might not complete correctly, and also that these exceptions should not have to be made since the software is from the same supplier. It would be nice if the Endpoint Protection Team and the Backup Exec team could colloborate on version upgrades to ensure that an upgrade does not cause issues with the other software package.

[Jim_Gordon]

I agree with techuser.  If we have to perform a full restore, then we will have to go back and reinstall SEP in order to get the pluggin files.  This is not a solution.  Why is it skipping the file?  Why doesn't open file or VSS backup the file?

[Colin_Weaver]

OK there are two problems in the original posters e-mail

The Skipped files (which are possibly locked in such a way that VSS can't access them either.)

And the completely missing file - which is a registry problem to do with something remaining in the registry pointing to a path that is no longer a valid path for the file in question. All the advice about creating /copying a file with the same name is against this problem and nothing to do with the skipped files.

[Cameron_Lawton]

I had the same problem. I updated from Symantec Endpoint Protection 11.0 to SEP 12.1 and these errors started appearing in my backups.

http://www.symantec.com/docs/TECH168444 suggested going to Backup Exec->Edit->Manage Selection Lists and adding the folder \ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\CmnClnt\_lck\ to the Excludes list. " These files are intentionally created as DELETE_ON_CLOSE and should not be backed up."

The two system files are referenced under the HKLM\System\CurrentControlSet\Services but there are no services for it and running TASKLIST /SVC shows no processes for this running. I do not see any errors in the System log for it. I backed up and deleted the registry entries and no longer have any errors during backup nor am I seeing errors in the System logs for the servers or in Symantec Endpoint Protection management console. I think updating the SEP client to 12.1 failed to remove the entries from the registry and caused the backup of System State to fail.

Cameron