Video Screencast Help
Symantec Appoints Michael A. Brown CEO. Learn more.

C Drive is filling up in SEPM 12.1.1 MP1

Created: 21 May 2012 • Updated: 22 May 2012 | 18 comments
This issue has been solved. See solution.

We have Symantec_Endpoint_Protection_12.1.1_MP1 Management server installed on Windows 2003 Enterprise server. Nowadays I have noticed that C drive of the Server is getting filled up. After investigation through files and folders, I have found that C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\content folder using 29GB in the C Drive.

Specially the folders of the name {07B590B3-9282-482f-BBAA-6D515D385869} contains 13GB and {535CB6A4-441F-4e8a-A897-804CD859100E} contains 15GB data.

Eventhough I extend the C drive with another 10GB, symantec easily filled that one too. Now I have 0 bytes free in C drive. Please help to solve this issue.

Comments 18 CommentsJump to latest comment

Mithun Sanghavi's picture

Hello,

Check this Article and work on the same.

Symantec Endpoint Protection Manager 12.1 database using a high amount of Hard drive space

https://www-secure.symantec.com/connect/articles/symantec-endpoint-protection-manager-121-database-using-high-amount-hard-drive-space

Check this Tool, which may assist you:

https://www-secure.symantec.com/connect/downloads/shrink-symantec-endpoint-protection-manager-121-embedded-database

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

abhilashkrishn's picture

 I trucated database logs and rebuild indexes as per your info. But now also the problem persists. We are not using Embedded database, we have seperate SQL server.

abhilashkrishn's picture

We have 5000 clients, so I changed number of revisions to 30 as per your document. But not solved the issue.

pete_4u2002's picture

it will take a days time after data sweep to take this effect.

Mithun Sanghavi's picture

Hello,

When you open the Folders {07B590B3-9282-482f-BBAA-6D515D385869} and {535CB6A4-441F-4e8a-A897-804CD859100E}. How many sub folders do you see inside them?

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

Chetan Savade's picture

Hi,

Delete the Sub folders present under  {07B590B3-9282-482f-BBAA-6D515D385869} and {535CB6A4-441F-4e8a-A897-804CD859100E} 

Run the liveupdate again & recheck the size of above folders.

It might be happening due to corrupt definitions.

Chetan Savade
Sr Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

AravindKM's picture

Try by reducing the number of revisions to keep.

Also please review your sections-- Language, Platform, Content type under Admin-->servers-->site properties-->liveupdate

Please don't forget to mark your thread solved with whatever answer helped you : ) Thanks & Regards Aravind

Mick2009's picture

> We have 5000 clients, so I changed number of revisions to 30 as per your document. But not solved the issue.

The more past revisions that you keep, the better the SEPM will be able to provide smaller "delta" definition updates to SEP clients that are farther out-of-date. 

If you have ample bandwidth and can handle clients that are out of date by a week or more downloading full definitions (up to 200 MB) then reduce the number of past content revisions to 20, rather than 30.

Also make sure that the SEPM database is not keeping old client logs for a long time- that can also consume space.

Hope this helps!

 

 

With thanks and best regards,

Mick

abhilashkrishn's picture

At last the solution of the pete_4u2002 got the point.

I reduced the number of revisions to 3.

I stopped SEPM, SEPM Webserver and IIS Admin services and deleted all the folders in the C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\content.

Reconfigured using Management Wizard and restarted the server. Now it is working fine.

I will increase the revision numbers later after observing the disk usage. Can somebody please explain me what is the importance of keeping more revisions.

pete_4u2002's picture

it will help to save bandwidth since delta content will be generated by SEPM and be distributed to GUP/clients. If the SEPm does not generate delta becuase of low content revision then the full content which is nearly 180 MB will be sent to client/GUP which might impact bandwidth.

Mick2009's picture

How to change the number of downloaded content revisions that are retained by the Symantec Endpoint Protection Manager versions 11.0. or 12.1
Article: TECH104845   |  Created: 2008-01-02   |  Updated: 2012-01-10   | 
Article URL http://www.symantec.com/docs/TECH104845

The more past revisions that you keep, the better the SEPM will be able to provide smaller "delta" definition updates to SEP clients that are farther out-of-date. 

If you have ample bandwidth and can handle clients that are out of date by a week or more downloading full definitions (up to 200 MB) then reduce the number of past content revisions to 20, rather than 30.

Keeping only 3 revisions means that SEP clients more than a day out of date will need the full download.  (There are, on average, 3 releases of certified SEP definitions released every weekday)

 

 

 

With thanks and best regards,

Mick

abhilashkrishn's picture

Is there any way to reduce the disk usage, now I have set only 3 revisions to keep and it is already using 1.15GB. If I set more number of revisions I think it will eat my whole harddisk. Hello Symantec, is there any to avoid this problem.

Mick2009's picture

What version of SEP are you using, and how small is that C drive-?

With thanks and best regards,

Mick

abhilashkrishn's picture

It is Symantec_Endpoint_Protection_12.1.1_MP1. And C Drive contains 68GB space.

Mick2009's picture

Thanks for the extra details.

The folder should not grow to be very large in size if you are keeping only 3 revisions.  Unless space is running low due to other programs, etc installed on that server, it should be fine.

Do keep in mind that with only 3 revisions kept, there will be a lot of full definition sets passed down to this SEPM's clients...

With thanks and best regards,

Mick

pete_4u2002's picture

Thumbs up  to above advice, keep it 10 and slowly keep on increasing. or this should be very help

How to use a new Drive/Partition to host the SEP content directory without reinstalling
http://www.symantec.com/business/support/index?page=content&id=TECH103808
 

SUPPORT-2-SUPPORT's picture

If now you have sufficient space on SEPM drive then increase the revision to atleast 10 to 15 for avoid bandwidth and network issues.

 

Regards,

S2S

 

Please don't forget to mark your thread solved with whatever answer helped you.