Endpoint Protection Manager replication fails: Invalid Hex String:12
search cancel

Endpoint Protection Manager replication fails: Invalid Hex String:12

book

Article ID: 163698

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

The replicating server fails to submit data to the replication partner.  In the ReplicationLocal-0.log, the following error can be seen:

Unable to fetch changed data from remote site [<SITE NAME>]: Invalid Hex String:12

error: Unable to fetch changed data from remote site [<SITE NAME>]: Invalid Hex String:12 

Cause

ATP is installed and attached to the Symantec Endpoint Protection Manager (SEPM) and database.  When a custom blacklist is created, it changes the value of the DOMAIN_ID in the BINARY_FILE from NULL to 12.  This will cause a mismatch when the SEPM attempts to replicate with its partners in other sites and the replication will fail.

Resolution

  1. Locate the Invalid Hex String:12 error in the replicationLocal-0.log file.  Above the error, locate the guid.  This number will be different for every environment.  Copy the guid for use in the update query.

  2. Backup the SEPM database
  3. Log into SQL Server Management Studio.
  4. Expand Databases and select the SEP database.
  5. Run the following query except with the appropriate GUID from the Replication log (replace the the GUID from the example query with the guid from the logs) 
    Select DOMAIN_ID from BINARY_FILE group by DOMAIN_IDselect * from BINARY_FILE where ID = '78????????????????????????????80'
  6. If the value of 12 is returned for the DOMAIN_ID, run the following query to correct the issue (again replacing the the GUID from the example query with the guid from the logs: 
    update BINARY_FILE
    set DOMAIN_ID=Null, OWNER=Null
    where ID= '78????????????????????????????80';
Powered by Wolken Software