Endpoint Protection

since moving to 12.1.6 we now get the overload reports from excessive full download. is there a method to get a report of whats happening through say a 24 hour period so we can see all the downloads

You can check the system log under the monitors tab. Set the log type to System and log content to Client Activity and this should show which clients are downloading full sets:

This article should provide guidance on filtering:

SEPM 12.1 - Advanced Settings filter options for Client Activity logs

https://www-secure.symantec.com/connect/articles/sepm-121-advanced-settings-filter-options-client-activity-logs

Set the event source to sylink:

this quick report can meet your need

thanks its actually the sizes i want. so similar idea to the network overload report. more so i can see if its the same clients with big pulls - if specific builds are pulling more etc. not sure if it would maybe need to be a direct sql pull?

it is not possible to know the exact size all you can get to know from SEPM is whether a client is download full.zip or a delta. let me know if that suffices your need.

Thanks - i should be able to work it out from the details above. thanks for response and links

you're welcome :)

The will obvioulsy tell you whether a full or delta was downlaoded but in order to see sizes, you would need to enable sylink logging on the client. Very tedious to though with many clients.