Endpoint Protection Manager database transaction log (sem5.log) consumes excessive hard drive space

Article:TECH178718  |  Created: 2012-01-11  |  Updated: 2015-02-18  |  Article URL http://www.symantec.com/docs/TECH178718
NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.
Article Type
Technical Solution


The database transaction log for Symantec Endpoint Protection 12.1.1 (RU1) Small Business Edition (SEP SBE) becomes excessively large, possibly to 20GB or more in size.


The Windows Application Event Logs may contain SQL ANY 11.0 errors containing the text:

Fatal error, disk full when writing to "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db\sem5.log"

Windows System Event Log may contain the following:

[date] [time] Warning Srv SERVERNAME N/A 2013 The C: disk is at or near capacity.  You may need to delete some files.



SEP 12.1 with an Enterprise license has options to configure how often SEP can perform database maintenance.  SEP SBE is designed to perform this database maintenance as well, but on a fixed schedule that is not configurable within the user interface.  In SEP SBE 12.1.1, the transaction log does not seem to reduce in size.  In SEP SBE, there is also no Truncate Transaction Log Now button.  


This problem is fixed in Symantec Endpoint Protection 12.1 Release Update 1 Maintenance Patch 1 (RU1 MP1).  See how to download the latest version of Symantec Endpoint Protection.

The following workaround can be used until you are able to migrate the SEPM to a fixed version:

  1. Stop the Symantec Endpoint Protection Manager and Symantec Embedded Database services.
  2. Rename or delete the current sem5.log
  3. Click Start Run and type CMD then click OK
  4. In the command prompt type:

    • For 32-bit: CD C:\Program Files\Symantec\Symantec Endpoint Protection Manager\ASA\win32\
    • For 64-bit: CD C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\ASA\win32\
  5. Press Enter. This will change directories to the folder containing dbsrv11.exe.
  6. To force the recreation of sem5.log, type:

    • For 32-bit: dbsrv11 -f "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db\sem5.db"

      Note: There is a space between -f and "C:\...
    • For 64-bit: dbsrv11 -f "C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\db\sem5.db"

      Note: There is no space between x and 86, and there is a space between -f and "
  7. Press Enter
  8. Click Start > Run.
  9. Type services.msc
  10. Click OK.
  11. Start the following services:
    • Symantec Endpoint Protection Manager
    • Symantec Embedded Database


Supplemental Materials


Article URL http://www.symantec.com/docs/TECH178718

Terms of use for this information are found in Legal Notices