After installing the product onto a Windows server it is determined the Symantec Protection Engine (SPE) and Common Agent Framework (CAF) services are not started. Manually attempting to start the SPE service results in the service temporarily starting then stopping with no obvious error.
When Symantec Protection Engine (SPE) service fails to start the log SymantecProtectionEngineAbortLog.txt is generated in <SPE Install path>\Symantec\Scan Engine\ directory. Upon review of this log the following lines are present:
1400 Failed to initialize IPC Channel. 0 Symantec Protection Engine is shutting down; logs may contain more information.
Additionally, the Common Angent Framework (CAF) cafagent.log located in <SPE Install path>\Symantec\Common Agent Framework\Log may show the following errors:
Exception caught during listener creation: I/O error Exception in starting request listener on plugin side
Symantec Protection Engine (SPE) and the Common Agent Framework (CAF) require ports 9001 and 9002 to be available during service start. If another application is holding these ports in use Symantec Protection Engine (SPE) service will stop.
To identify if the ports are currently available perform the following proceedure:
Open the command prompt (cmd.exe) from the Windows "run" prompt.
Run the following commands:
netstat -ban | findstr 9001
netstat -ban | findstr 9002
If any results are returned this would indicate an application currently has these ports in use. You will either need to identify the application holding the ports in use and change the port usage or modify the ports used by Symantec Protection Engine.
To modify the ports used by SPE:
Identify available port set using the "netstat" commands above to locate two unused ports.
Open the command prompt (cmd.exe) from the Windows "Run" prompt.
Navigate to <SPE Install path>\Symantec\Scan Engine\
Run the following commands: Replacing the port values of 9001, 9002 with your new values.