Endpoint Protection

So one nice change with 12.1.5 is the change to keeping deltas for content revisions, reducing the amount of disk space used.

We previously kept 3 content revisions, as that was the default for small installations, and disk space was an issue.

The upgrade to 12.1.5 automatically changed the configuration to keep 12 content revisions. When you look at the size of the base content (the full content) it's about 2.7 GB, while the deltas are mostly less than 1 MB. So it would seem to me that the disk space overhead of keeping additional deltas is very small.

As we have an environment with frequent liveupdate checks, and clients which can remain switched off for a considerable time it might be beneficial for us to increase the number of content revisions retained.

Other than the (slightly) increased disk space requirements are there any disadvantages to increasing the number of content revisions kept?

Disk space aside as you've mentioned I can't see this being an issue. They've made some nice changes to the way they're stored. Are your clients always updating, even when off network?

Clients aren't updating because they're not off network, they're just off!

I did have a thought that it would increase the time to generate deltas (because there are more of them), but I think the latest full content package is created from the last full package, plus a single delta (the latest), so I don't think that's an issue.

As Brian's said (and as you've also surmised) beyod the additional disk space usage, the only other real overhead of retaining more defs is the additional cpu overhead of generating the combined deltas (this is when the SEP bunches a load of incremental deltas together so it only has to habd a client one file).

That said, I don't think this combining of deltas is much more intensive than just creating the deltas in older SEPM method, so I imagine not much of a concern.

By the by, the on the SEPM side of things, I believe it always downloads the full defs, creates the deltas between the latest and the ones previous, then deletes the one previous' full def file.

Just to update this, the number of content revisions to keep has been changed to 90 (Symantec's highest recommended value), and there have been no noticable negative side effects.

The increased disk usage is very small, and is still less than we were using with 12.1.4 with only 3 content revisions kept.