We found the sem5.log become larger and larger since the end of Dec, and grows to around 60GB.

After restarted SEPM and embedded DB service, it resumed to 22MB.

But we found error Performance warning: Database file "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db\sem5.db" consists of 1450 disk fragments

and error "Performance warning: No unique index or primary key for table "AGENT_BEHAVIOR_LOG_1" in database "sem5""

Can you advise if any problem with the DB? Any protential risk ?

Thanks for advice~

use the db validator tool adn check

How to use the Database Validation tool (DBValidator.bat) for Symantec Endpoint Protection Manager

http://www.symantec.com/business/support/index?page=content&id=HOWTO39461

Not sure about your version but previous versions had this issue.

check this discussion

https://www-secure.symantec.com/connect/forums/sem5-file-endpoint-protection-121-too-big

What version are you running? This was an issue in a previous version of 12.1 and has since been fixed in a later release.

Check it

https://www-secure.symantec.com/connect/forums/embedded-database-stops-regularly-will-restart

sqla000.tmp file is consuming hard drive space

Thanks for your reply. My SEPM is of 12.1.2015.2015. It is new setup, not upgrade from old version.We think the warning of "error Performance warning: Database file "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db\sem5.db" consists of 1450 disk fragments" is a problem. But the warning of the index is just a information. Will the DB validation tools fix the fragment error?

I have run DBValidator.bat with below result. Can you check if the DB is healthy? It did not mention the disk fragment.

2413') AND DELETED=0 and CONTENT IS NOT NULL
2015-01-15 09:06:11.605 THREAD 1 INFO: *********************************************
2015-01-15 09:06:11.608 THREAD 1 INFO: Following ids are not present in the database.
2015-01-15 09:06:11.610 THREAD 1 INFO: *********************************************
2015-01-15 09:06:11.612 THREAD 1 INFO: Link is broken for [0] target ids :
2015-01-15 09:06:11.614 THREAD 1 INFO: *********************************************
2015-01-15 09:06:11.617 THREAD 1 INFO: Link is broken for [0] physical file ids :
2015-01-15 09:06:11.619 THREAD 1 INFO: *********************************************
2015-01-15 09:06:11.621 THREAD 1 INFO: Database validation passed.
2015-01-15 09:06:11.625 THREAD 1 INFO: Finished.

Looks fine

DB looks fine no issue, You can try running manamagent server configuration ones or rebuild the index

http://www.symantec.com/business/support/index?page=content&id=TECH168121

You can run the sylmhelp tool on sepm

Download the Symantec Help (SymHelp) diagnostic tool to detect Symantec product issues