Error: "Low Disk Space" on computers running Endpoint Protection

Article:TECH153952  |  Created: 2011-02-22  |  Updated: 2014-11-21  |  Article URL http://www.symantec.com/docs/TECH153952
Article Type
Technical Solution


Issue



The computer produces an error stating "Low Disk Space" after installing Symantec Endpoint Protection Manager (SEPM) or Symantec Endpoint Protection (SEP).
 


Error



Low Disk Space
You are running very low on disk space on Local Disk (C:). To free space on this drive by deleting old or unnecessary files, click here...

 


Cause



There are multiple causes for this issue. This article is not intended as an all-encompassing guide to every possible cause of disk space issues related to SEP or SEPM installations. However, it covers some of the most common causes and solutions.
 
 


Solution



Before you troubleshoot the issue, it is important to know which drive is running low on disk space and which folder is using the highest amount of disk space on the drive. There are a variety of free third-party utilities to aid in the investigation of which specific folders and files are using the most disk space on a given drive.

Once you know the status (i.e. disk space available) for the system, you can begin to troubleshoot.

To optimize disk space on Windows

  1. Run Windows Disk Cleanup manually. See Microsoft documentation for assistance on using this utility: Delete files using Disk Cleanup
  2. Uninstall any unwanted or unnecessary software from the system.

There are different courses of action depending on whether the SEP client or the SEPM is the source of the excessive disk usage.

 
For the Symantec Endpoint Protection client

According to the product system requirements, the SEP 12.1.x client requires approximately 850 MB of available hard drive space, and SEP 11.x client requires at least 600 MB of free hard disk space. Contents and logs requires additional space. SEP 12.1 typically manages disk space better than SEP 11. Upgrade to the latest available release of the product, if possible.

The LiveUpdate component is always installed on the C: drive, regardless of any custom installation path selected for the SEP client.

Check to make sure enough disk space is available. If the SEP client uses large amount of disk space, these steps can help to reduce the amount of space consumed by a SEP client.

 
I. Stopping the Symantec client service

  1. Click Start, then type Run and press Enter.
  2. Type the following command: smc -stop
  3. Click OK.

 
II. Deleting the files

Perform these steps using Command Prompt (cmd.exe), as deleting the files through Windows Explorer may result in delays and application hangs. These instructions direct you to delete the files in the targeted folders, not the folders themselves. Do not delete the enclosing folders themselves.

NOTE: As a precaution, you should back up the system before you delete the files in case you experience problems resulting from this procedure.

  1. Click Start, type cmd and press Enter.
  2. Within the Command Prompt window, type the following command to empty the temporary folder:
    • For Windows 2000/XP/2003:
      DEL /F /Q "C:\Documents and Settings\NAMEOFUSER\Local Settings\Temp"
    • For Windows Vista and later:
      DEL /F /Q "C:\Users\NAMEOFUSER\AppData\Local\Temp"
    Where NAMEOFUSER is the username of the desired Windows user for which you wish to empty the temporary folder.
  3. Type the following command to empty the temporary folder at the root of the C: drive:
    DEL /F /Q C:\temp
  4. Type the following command to empty the Windows temporary folder:
    DEL /F /Q C:\WINDOWS\Temp
  5. Type the following commands to empty the xfer and xfer_temp directories:
    For SEP 12.1.x:
    • Windows XP/2003:
      DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\xfer_tmp"
      DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\xfer"
    • Windows Vista and later:
      DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\xfer_tmp"
      DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\xfer"
    For SEP 11.x:
    • Windows 2000/XP/2003:
      DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer_tmp"
      DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer"
    • Windows Vista/7/2008:
      DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer_tmp"
      DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer"
  6. Leave the Command Prompt window open for the next set of steps.

 
III. Deleting and recreating the Quarantine folder

If there are too many items in Quarantine, you may be unable to delete the quarantined items through the SEP client interface. Perform these steps using Command Prompt (cmd.exe), as attempting to open the Quarantine folder, or deleting the files through Windows Explorer, may result in delays and application hangs. This issue can occur due to the large amount of files that can reside there.

  1. Within the Command Prompt, type the following command to delete the Quarantine folder:
    For SEP 12.1.x:
    • Windows XP/2003:
      DEL /F /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Quarantine"
      RD /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Quarantine"
    • Windows Vista and later:
      DEL /F /S /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Quarantine"
      RD /S /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Quarantine"
    For SEP 11.x:
    • Windows 2000/XP/2003:
      DEL /F /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"
      RD /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"
    • Windows Vista/7/2008:
      DEL /F /S /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine"
      RD /S /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine"
  2. Type the following command to recreate the Quarantine folder:
    For SEP 12.1.x:
    • Windows 2000/XP/2003:
      MD "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Quarantine"
    • Windows Vista and later:
      MD "C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Quarantine"
    For SEP 11.x:
    • Windows 2000/XP/2003:
      MD "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"
    • Windows Vista/7/2008:
      MD "C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine"
  3. Close the Command Prompt window.

IV. Starting the Symantec service

  1. Click Start, then type Run and press Enter.
  2. Type the following command: smc -start
  3. Click OK.

 
For the Symantec Endpoint Protection Manager

The most typical cause can occur when you do not disable debug mode of the SEPM after troubleshooting an issue. Debug mode collects a large amount of data and can lead to log files becoming very large, including catalina.out, which can grow larger than 1 GB or more in size.

You can remedy this situation as follows:

  1. Open Windows Services, and stop the Symantec Endpoint Protection Manager service.
  2. Open the following file with a text editor such as Notepad:
    SEPM Installation Folder\tomcat\etc\conf.properties
    Where SEPM Installation Folder is the installation folder into which you installed the SEPM. By default, this folder is C:/Program Files\Symantec\Symantec Endpoint Protection Manager on 32-bit systems, and C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager on 64-bit systems.
  3. Search for the line scm.log.loglevel=, delete FINEST or ALL, and replace it with WARNING.
  4. Save and close the conf.properties file
  5. While the SEPM service is stopped, you can also delete or archive all the log files located in the folder SEPM Installation Folder\tomcat\logs.
    Note: Do not delete the logs folder; be sure to only move or delete the contents of the logs folder
  6. Open Services, and start the Symantec Endpoint Protection Manager service.

Another common cause of this issue is retaining a large amount of definition content, which can lead to folder growth under SEPM Installation Folder\Inetpub\Content. To adjust the amount of content retained by the SEPM:

  1. Log on to the SEPM console.
  2. Click Admin > Servers > Local site > Edit Site Properties > LiveUpdate.
  3. Under Disk Space Management for Downloads, adjust the number of revisions accordingly.

See Disk Space Management procedures for the Symantec Endpoint Protection Manager for additional information on managing the number of content revisions retained by SEPM.

See Related Articles for more information on how to configure the SEP client and SEPM to overcome low disk space issues. 

 





Article URL http://www.symantec.com/docs/TECH153952


Terms of use for this information are found in Legal Notices