Video Screencast Help

Symantec Endpoint Protection Manager 12.1 database using a high amount of Hard drive space

Created: 31 Oct 2011 • Updated: 31 Oct 2011 | 11 comments
Language Translations
Mithun Sanghavi's picture
+10 10 Votes
Login to vote

Issue: The Symantec Endpoint Protection Manager (SEPM) folder for version 12.1 takes a lot of disk space. 

In version 11.X the workaround was to decrease the number of contents revisions, if they are not required to keep updates for specified days, then delete the revision folders manually from inside C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\Content\C60D... or 1CD8..., with the service stopped. TECH153952

In version 12.1 we do not have the same folders.

Also, the database transaction log file (sem5.log) may grow to 10-15 GB, or larger, after upgrade and it is not possible to log on to the manager.

Cause: Number of Content revisions are more than required. OR Did not select options to "Truncate the database transaction logs" and "Rebuild Indexes"

Solution:

1. Go to: C:\Program FIles\Symantec\Symantec Endpoint Protection Manager\Inetpub\Content (Default Location of SEPM) 

2. Check

- {535CB6A4-441F-4e8a-A897-804CD859100E} for 32 Bit

- {07B590B3-9282-482f-BBAA-6D515D385869} for 64 Bit

Note: These two folders take more disk space, compared to other folders which are used to store the Virus definitions

3. Once the number of content revisions has been decreased, then this would be reflected on the number of revision folders. See TECH96214 for recommendations.

 

To reduce the size of the database transaction log file :

 

1. Log in to the Symantec Endpoint Protection Manager.

2. Click Admin and select Servers.

3. Select the localhost under Servers.

4. Under Tasks, Select Edit Database Properties.

5. In the General tab under Database Maintenance Tasks.

6. Select the checkboxes next to Truncate the database transaction logs and Rebuild Indexes.

7. Click OK to apply the changes.

It will make changes to the database on the mentioned time under "Scheduled task". To reflect the changes immediately click on Truncate Database Transaction Log Nowand Rebuild Indexes Now under Tasks.

Once this is done, a lot of disk space will be freed up on the C drive.

 

If incase, you are unable to log on the the manager, you can recreate the sem5.log file to resolve the issue.

1) Stop SEPM and database services.

2) Rename / Delete the current log

3) Click Start, click on Run and Type "CMD" then click OK

4) In the Command Prompt type: "CD C:\Program Files\Symantec\Symantec Endpoint Protection Manager\ASA\win32\" and press Enter this will change directories to the folder containing dbsrv11.exe.

5) To force the recreation of sem5.log. Type: "dbsrv11 -f "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db\sem5.db" and press Enter

6) Click Start, click on Run and Type "services.msc" then click OK and start the Symantec Embedded Database Service

7) Start the Symantec Endpoint Protection Manager service.

 

Also, Please check ContentInfo.txt file for more information about the folders stored in Symantec Endpoint Protection Manager folder

Comments 11 CommentsJump to latest comment

Mithun Sanghavi's picture

Hello,

Symantec is aware and is investigating this issue.

Check this Article: http://www.symantec.com/docs/TECH178718

A fix is currently expected in the forthcoming release, SEP SBE 12.1 RU1 MP1.

Until that release is available, a tool is available from Symantec Technical Support to enable the necessary maintenance on SEP 12.1 RU1 SEPMs.  Please contact Technical Support to receive this tool.  After it is run once, the SEPM's sem5.log file will truncate and remain at the correct size.

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

0
Login to vote
v6krsan's picture

Hi Mithun,

 

Could you please help me get this tool mentioned above to truncate sem5.log in SEP12.1 SBE

0
Login to vote
Mithun Sanghavi's picture

Hello,

Check this Tool, which may assist you:

https://www-secure.symantec.com/connect/downloads/shrink-symantec-endpoint-protection-manager-121-embedded-database

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

0
Login to vote
Mithun Sanghavi's picture

Hello,

Incase, if you are carrying SEP SBE 12.1, then check this Article:

Symantec Endpoint Protection Manager (SEPM) database transaction log (sem5.log) consumes excessive hard drive space in SEP SBE 12.1 RU1

http://www.symantec.com/docs/TECH178718

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

0
Login to vote
Ashish-Sharma's picture

Hi Mithun,

Thanks for sharing good artical yes

Thanks In Advance

Ashish Sharma

 

 

0
Login to vote
Skiextreme2013's picture

So I'm still trying to figure out why on our production enviornment with well over 100 clients, the database is only 4GB.  However, in the new enviornment I am building that only has about 6 clients, the database is well over 31GB.  Does anyone have any idea why?

 

The database is on a separate share from where SEPM is installed.  I did confirm that the sem5 log file is not the culprit here.  Any help anyone can offer would be appreciated.

0
Login to vote
ashton_har's picture

Is there a guide like this for SEPM in Small Business Installations ?

Because i can't find any database properties in the admin tab ..

0
Login to vote
Skiextreme2013's picture

I wound up opening a ticket with support.  I was informed that the recomended amount of revisions is 3.  Also, if the drive SEPM is installed on runs low on hard drive space, the clients will cease to communicate with the SEPM.  This appears to be SEPM's way of protecting the database. 

0
Login to vote
John Santana's picture

Hi All,

I'm using SEPM 12.1.3001.165 and there is one large file 2 GB+ GUID filename and zipped in C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\replication\outbox\

Can I safely delete this file ?

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

0
Login to vote
pete_4u2002's picture

why do you want to delete that file?

are you running out of space. if you are talking about data.zip it's data for the replication. You can delete this, however next time you will have one more file created during the replication schedule.

+1
Login to vote
John Santana's picture

Pete,

Yes i am running out of disk space at the moment. My understanding is that when this file is deleted, the scheduled SEPM replication will be failed and then the file will be created again ?

Kind regards,

John Santana
IT Professional

--------------------------------------------------

Please be nice to me as I'm newbie in this forum.

0
Login to vote