Running a Windows 2003 Server with Symantec Endpoint Protection Manager 12.1.2015.2015. On this server, the SEPM directory in Program Files is taking up 22 GB of space. In trying to reduce this, we've looked at where one can log into the SEPM console, go to Admin > System > Local Site and set the Database properties there however when we look under system, there is no localhost or Local Site listed, only the name of our server. Under Tasks, all we have is Server Properties, which only allows modification of email notifications, proxy, LU frequency but no Database management. We'd like to limit the LU cache but wanted to know what else we can clear to reduce the disk footprint.

So problem #1 is how to get Local Site to show up so we can configure the database/LU. Problem #2 is the excessive (?) disk space usage by the product.

Hello,

Check some articals

Disk Space Management procedures for the Symantec Endpoint Protection Manager

http://www.symantec.com/business/support/index?page=content&id=TECH96214

Symantec Endpoint Protection Manager 12.1 database using a high amount of Hard drive space

https://www-secure.symantec.com/connect/articles/symantec-endpoint-protection-manager-121-database-using-high-amount-hard-drive-space

Look this discussion

https://www-secure.symantec.com/connect/forums/sepm-1212-inetpub-folder-takes-alot-space

Hi

Please follow the link below

http://www.symantec.com/business/support/index?page=content&id=TECH169786&actp=search&viewlocale=en_US&searchid=1367483654897

Regards

Check the mithun comment

www.symantec.com/connect/forums/disk-space-issues

Hello,

Please check the below article for the same.

Symantec Endpoint Security Manager: How is Database Maintenance scheduled? 

http://www.symantec.com/business/support/index?page=content&id=TECH95880

Changing the log settings to reduce the size of the database

http://www.symantec.com/business/support/index?page=content&id=TECH105238

How to quickly purge the SEPM log tables on a SQL server

Also, Check these Articles:

Symantec Endpoint Protection (SEP) 12.1 client is maintaining multiple virus definitions versions on servers

http://www.symantec.com/business/support/index?page=content&id=TECH180056

How to clear out definitions for a Symantec Endpoint Protection 12.1 client manually

http://www.symantec.com/docs/HOWTO59193

Drive Space used by Virus Definitions Updates

Hi Electromojo,

Please mention the folders of your SEPM install path which are really big.

See as well on your SEPM Console how many Live Update contents you're keepin (local site, modify site properties, Live Update tab, Disk space management for download, Live Update content to keep: [X].

Note as well there is a small defec that may induct to Disk space issue that will be fixed on the next release (RU3).

If you'e encountering it, you can delete all the files located on this specific folder without any problem and monitor it.

%\Symantec\Symantec Endpoint Protection Manager\data\outbox\ImportPackage\

If you have numerous files on the ImportPackage folder you can delete them (basically there is no need to stop any services to remove them).

Check as well if your sem5.log has decent size (it can grow up to few Gb but it's getting truncated by default every 4 hours and get back a size like 576Kb when it's getting truncated).

Ensure the database maintenance tasks are activated on your SEPM Console.

Admin\Servers\localhost\Edit Database Properties\On the first tab "General" you have at the bottom of this menu "Truncate database logs transaction and Rebuild indexes tables". Ensure the both boxes are checked.

Kind Regards,

A. Wesker

Hi,

Helpful articles:

Disk Space Management procedures for the Symantec Endpoint Protection Manager

http://www.symantec.com/docs/TECH96214

Changing the log settings to reduce the size of the database.

http://www.symantec.com/docs/TECH105238

Managing log data in the Symantec Endpoint Protection Manager (SEPM)

http://www.symantec.com/business/support/index?page=content&id=TECH90856

Drive Space used by Virus Definitions Updates

http://www.symantec.com/docs/TECH141811

Wow, thanks for all the information everyone! We're still trying to review it all but presently a large number of it not accessible to us because we do not have the ability to see Local Site or localhost in our SEPM console under Admin > Servers (see screenshot attached). WIthout being able to click on Local Site, we don't have the option to set LU settings, log settings or database settings which form the bulk of the suggestions above. Should we post that part of the problem in a separate post?

A. Wesker:

The Symantec Endpoint Protection Manager directory has the following disk usage (out of 22 GB):

\data\outbox\ImportPackage\ ~9 GB

\data\backup\2013-Apr29_04-00-03.zip ~2 GB

\Inetpub\content ~4.5 GB

\Inetpub\ClientPackages ~1.5 GB

\db\sem5.db ~3 GB

The rest is smaller and rounds out the space usage. sem5.log is about 1 MB but is that a normal size for sem5.db? Note that this site has only 14 clients. Is that backup zip file above necessary? Any of the other directory sizes look abnormal? We'll definitely remove all the files from ImportPackage as that is almost half the space usage by SEPM. Thanks for that tip. However, how did that accumulate and is that something we can adjust once the problem with missing Local Site settings is resolved?

Thanks!

Hey electromojo!

Your screenshot answers a lot of questions! Your SEPM is NOT Enterprise Edition (EE), it is Small Business Edition (SBE). Most of what was previously suggest is only available in EE. SBE is far less "granular" than EE.

Deleting files found in: ...\Symantec\Symantec Endpoint Protection Manager\data\outbox\ImportPackage can be done with complete safety.

MJD

MichaelD50:

Thanks for the reply. Apologize if we implied that we had the EE or posted to the wrong forum. So with SBE, we cannot change any of those settings at all? Do we need to regularly check this ImportPackage directory and clear it manually? How often do those files get created? Do any of the other sizes look normal for a 14 client site? Can we affect how often those files are created/maintained with SBE?

MichaelD50:

I'm in the same boat as electromojo, I'm also running SBE and I'm down to just over a gig of free space.

I had to re-partitioned the boot partition on a SBE 2003 server just to make room for Symantec and it's gobbled it all up. I thought 25 GB would have been enough, I guess not.

My \All Users\Application Data\Symantec\Symantec Endpoint Protection is 12 GB with 2 separate virus defs folders, with the same files in them. I don't need virusdefs going back to december, let alone 2 copies.

One is in a folder called CurrentVersion while the other is 12.1.1101.401.105. Both are in All Users\Application Data\Symantec\Symantec Endpoint Protection

Program Files\Symantec\Symantec Endpoint Protection Manager uses another 12 GB.

Program Files\Common Files\Symantec Shared\SymcData is another 2 GB.

My importpackage folder is only 500MB however, not much space savings there.

There really isn't much you can do in SBE to configure anything, the menu's are pretty bare.

A. Wesker:

The files in ImportPackage seemed to be growing by 2 GB per month since we upgraded SEP to the version we are using now. We can delete all the files but can we restrict how they grow and/or have these files automatically pruned with the SBE or do we have to manually do this?

Accoring this Mithun's post here:

https://www-secure.symantec.com/connect/articles/high-disk-space-being-consumed-cprogram-filessymantecsymantec-endpoint-protection-managerda

It might seem that we need to do a Disaster Recovery? Is this necessary? The above post was from last year on RU1 possibly and since we're on RU2 (original 12.1 install) perhaps the issue is fixed? Can you shed light on what we can do to automate the reduction of unneeded files from our installation?

Thanks!

Hi Electromojo :)

You're welcome.

Disaster Recovery can fix the problem but in short term only. It's identified as a known issue with Embedded Database only. As you're on Small Business Edition, you can use only Embedded Database anyway so you do not have choice to delete and to monitor the folder during the time being. Anyway this folder is not getting big very quickly. You can easily monitor it safety once per week for example and delete everything you find inside so far without any issue.

However this is planned to be fixed permanently in 12.1 RU3 (This summer '13). No official date for the release sorry

Kind Regards,

A. Wesker

I've not tried the Disaster Recovery, but this solution here worked for me:

To adjust the number of content updates stored by Symantec Protection Center

1. Open the \Program Files\Symantec\Symantec Protection Center\tomcat\etc\conf.properties file.
2. Add the following setting to the file, (the example uses a value of 5, adjust the value as necessary, the default value is 10 if no entry is present)

   scm.lucontentcleanup.threshold=5

3. Close the conf.properties file and click Yes to save your changes.
4. Click Start > Run.
5. Type services.msc and click OK.
6. Right-click on Symantec Protection Center, and click Restart.
7. Close Services.

After reboot folder size started decreasing.
Adjusting this setting (content revisions) from SEP console didn't have any effect.

http://www.symantec.com/connect/forums/sepmanager-121-and-huge-inetpubcontent-folder#comment-6266131

Freed up about 6.5 GB for me.

Thanks again for the information A. Wesker! We're looking forward to the update and will monitor manually until then.

piafolla:

Does adjusting the conf.properties file work for the SBE version or only the Enterprise version?

Thanks!

Awaiting update on this thread !!!

Sorrry for not replying. I only have access to the SBE version, I can't speak to the Enterprise version unfortunately.