Endpoint Protection

We have Symantec_Endpoint_Protection_12.1.1_MP1 Management server installed on Windows 2003 Enterprise server. Nowadays I have noticed that C drive of the Server is getting filled up. After investigation through files and folders, I have found that C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\content folder using 29GB in the C Drive.

Specially the folders of the name {07B590B3-9282-482f-BBAA-6D515D385869} contains 13GB and {535CB6A4-441F-4e8a-A897-804CD859100E} contains 15GB data.

Eventhough I extend the C drive with another 10GB, symantec easily filled that one too. Now I have 0 bytes free in C drive. Please help to solve this issue.

Hello,

Check this Article and work on the same.

Symantec Endpoint Protection Manager 12.1 database using a high amount of Hard drive space

https://www-secure.symantec.com/connect/articles/symantec-endpoint-protection-manager-121-database-using-high-amount-hard-drive-space

Check this Tool, which may assist you:

https://www-secure.symantec.com/connect/downloads/shrink-symantec-endpoint-protection-manager-121-embedded-database

Hope that helps!!

Disk Space Management procedures for the SEPM
http://www.symantec.com/business/support/index?page=content&id=TECH96214
 

 I trucated database logs and rebuild indexes as per your info. But now also the problem persists. We are not using Embedded database, we have seperate SQL server.

We have 5000 clients, so I changed number of revisions to 30 as per your document. But not solved the issue.

it will take a days time after data sweep to take this effect.

Hello,

When you open the Folders {07B590B3-9282-482f-BBAA-6D515D385869} and {535CB6A4-441F-4e8a-A897-804CD859100E}. How many sub folders do you see inside them?

Hi,

Delete the Sub folders present under  {07B590B3-9282-482f-BBAA-6D515D385869} and {535CB6A4-441F-4e8a-A897-804CD859100E} 

Run the liveupdate again & recheck the size of above folders.

It might be happening due to corrupt definitions.

Try by reducing the number of revisions to keep.

Also please review your sections-- Language, Platform, Content type under Admin-->servers-->site properties-->liveupdate

> We have 5000 clients, so I changed number of revisions to 30 as per your document. But not solved the issue.

The more past revisions that you keep, the better the SEPM will be able to provide smaller "delta" definition updates to SEP clients that are farther out-of-date. 

If you have ample bandwidth and can handle clients that are out of date by a week or more downloading full definitions (up to 200 MB) then reduce the number of past content revisions to 20, rather than 30.

Also make sure that the SEPM database is not keeping old client logs for a long time- that can also consume space.

Hope this helps!

At last the solution of the pete_4u2002 got the point.

I reduced the number of revisions to 3.

I stopped SEPM, SEPM Webserver and IIS Admin services and deleted all the folders in the C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\content.

Reconfigured using Management Wizard and restarted the server. Now it is working fine.

I will increase the revision numbers later after observing the disk usage. Can somebody please explain me what is the importance of keeping more revisions.

it will help to save bandwidth since delta content will be generated by SEPM and be distributed to GUP/clients. If the SEPm does not generate delta becuase of low content revision then the full content which is nearly 180 MB will be sent to client/GUP which might impact bandwidth.

How to change the number of downloaded content revisions that are retained by the Symantec Endpoint Protection Manager versions 11.0. or 12.1
Article: TECH104845   |  Created: 2008-01-02   |  Updated: 2012-01-10   | 
Article URL http://www.symantec.com/docs/TECH104845

The more past revisions that you keep, the better the SEPM will be able to provide smaller "delta" definition updates to SEP clients that are farther out-of-date. 

If you have ample bandwidth and can handle clients that are out of date by a week or more downloading full definitions (up to 200 MB) then reduce the number of past content revisions to 20, rather than 30.

Keeping only 3 revisions means that SEP clients more than a day out of date will need the full download.  (There are, on average, 3 releases of certified SEP definitions released every weekday)

Is there any way to reduce the disk usage, now I have set only 3 revisions to keep and it is already using 1.15GB. If I set more number of revisions I think it will eat my whole harddisk. Hello Symantec, is there any to avoid this problem.

What version of SEP are you using, and how small is that C drive-?

It is Symantec_Endpoint_Protection_12.1.1_MP1. And C Drive contains 68GB space.

Thanks for the extra details.

The folder should not grow to be very large in size if you are keeping only 3 revisions.  Unless space is running low due to other programs, etc installed on that server, it should be fine.

Do keep in mind that with only 3 revisions kept, there will be a lot of full definition sets passed down to this SEPM's clients...

Thumbs up  to above advice, keep it 10 and slowly keep on increasing. or this should be very help

How to use a new Drive/Partition to host the SEP content directory without reinstalling
http://www.symantec.com/business/support/index?page=content&id=TECH103808
 

If now you have sufficient space on SEPM drive then increase the revision to atleast 10 to 15 for avoid bandwidth and network issues.