Can Someone explain how content revisions and the number of revisions determine how clients are updated. If the SEPM is configured to save 30 revisions, How many does the client actually store. Does this determine the amount of disk space used on the clients and the SEPM.

Below is from the Best Practices document from Symantec.

Change the number of content revisions stored by the SEPM database to at least 10.

• This allows SEP clients which are out-of-date by approximately 3-4 days to still get incremental content updates.
• It is not uncommon to set the content revisions to as high as 42 (this covers approximately 2 weeks for incremental content updates).
  
  Note: Increasing the number of content revisions for the Symantec Endpoint Protection Manager will increase disk space usage in the SEPM install directory by approximately 6GB per 10 content revisions stored. 42 Content Revisions would use about 21GB of storage space on the drive where SEPM is installed to store updates.

See if these help:

http://www.symantec.com/docs/TECH92225

http://www.symantec.com/docs/HOWTO53175

By default 11.x clients keeps 3 revisions and 12.1 client keep only 1 revision.

So clients don't have to download full defs every time, they can download deltas.

If 30 revisions are kept this equates to roughly 10 days worth of content (3 revisions per day mon-fri and 1 on sat and 1 on sun). If the clients content date is within this range it will download a delta instead of a full set.

Thanks _Brian.

What would cause the updates folder to grow so large in size? What would cause the corrruption in the Virus Definitions? We are starting to experience an issue whereby corrupt defs are taking up alot of space on production servers and reboot isnt an option. I have seen the KB article to clear out the Defs Manually, But is there anything that can be done on the console to remidiate this problem on a larger scale?

check if it helps

When will a client download a full definition set from a Symantec Endpoint Protection Manager or Group Update Provider?

Usually happens when corrupted. There is nothing that can be done from the SEPM, it all needs to be done on the client.

There could be a few reasons:

• network blip during update
• low disk space
• client disconnects
• bad/wrong info in registry or usage.dat

A few others are outlined here:

http://www.symantec.com/docs/TECH92043