Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

GUPXManager - Content Definition question

Created: 03 Dec 2012 • Updated: 04 Dec 2012 | 10 comments
bennacchio's picture
This issue has been solved. See solution.

Hello to all,

I am working with some medium to big SEP enviroments and would like one simple clarification that sometimes passes unclear.

I believe I am pretty aware about the relation between How many content revisions to keep on Manager to avoid full pack definitions requests and how much disk do I need to reserve on my manager server. For instance if I keep 30 contents on my manager (knowing that my console goes only once a day on LU website) that will reflects in something close to 25GB of disk in my server (opened contents + 32bits and 64bits) and that would guarantee that systems with definitions 29 days old, would still pickup only the DELTA (right?).

But what is not clear to me so far is, once I elect one system as GUP  and lets say I keep default LU pol, on Maximum disk cache size for it 500MB and delete content if unused 3 days.

 

1) When a SEP client requests 15 days of denifinition to its GUP, GUP goes to Manager and gets this DELTA, after that if another client requests to this same GUP 10 days of definition, will it uses the last 15days delta already downloaded or GUP will actually goes to manager again and get the 10days delta?

2) When a SEP client is just installed using a SETUP.exe in my network, it will obviously request a full pack to its GUP, GUP goes to Manager and download aprox 140MB for full pack, if a another system request 20days definition delta, will my GUP use that full pack and wouldn´t it be a good practise to increase the "delete content if unused" in my GUP pol to something like 30 days avoiding full packs download as much as possible? 

 

Sorry for my english and hopefully I was clear about my 2 questions,

Thanks and Best Regards,

Comments 10 CommentsJump to latest comment

Elisha's picture

For instance if I keep 30 contents on my manager (knowing that my console goes only once a day on LU website) that will reflects in something close to 25GB of disk in my server (opened contents + 32bits and 64bits) and that would guarantee that systems with definitions 29 days old, would still pickup only the DELTA (right?).

We release 3 updates each day.  If you keep 30 content revisions that will give you deltas for only 10 days.  You would need to store 90 revisions to send out deltas for 30 days.

1) When a SEP client requests 15 days of denifinition to its GUP, GUP goes to Manager and gets this DELTA, after that if another client requests to this same GUP 10 days of definition, will it uses the last 15days delta already downloaded or GUP will actually goes to manager again and get the 10days delta?

It will go back to the manager and get the 10days delta.

2) When a SEP client is just installed using a SETUP.exe in my network, it will obviously request a full pack to its GUP, GUP goes to Manager and download aprox 140MB for full pack, if a another system request 20days definition delta, will my GUP use that full pack and wouldn´t it be a good practise to increase the "delete content if unused" in my GUP pol to something like 30 days avoiding full packs download as much as possible?

Clients will always request the latest definition.  If the 140MB def that the first client requested is still the latest def then when the second client (that has 20days old def) asks for an update then the GUP will still send the full def it has.  However if a new def was released in the mean time then the second client will be requesting the latest def and so in this case the GUP will need to download a new 140MB full def for the second client.

Note: AV def updates are released every 8 hours.

bennacchio's picture

Thanks Elisha, for all clarifications,

Just one more to close the case:

Will the 30 contents give me only 10 days of defitinions even when my console is scheduled to only download ONCE a day, let´s say every day at 12:00 AM?

 

 

Elisha's picture

I would not recommend having SEPM download content only once a day.  This would make it so that the manager would not have every definition update.  If a client has a definition version that SEPM does not have then SEPM will give out a full definition to that client even if the client's definition is only one day old.

SEPM can only give out delta files from definition versions that it has.  If SEPM does not have a definition version that a client has than it cannot send out a delta file to that client.

Ian_C.'s picture

 If a client has a definition version that SEPM does not have

True, but here's the catch. The clients only download updates from the SEPM, thus they will only get updates / deltas from the SEPM based on the definitions the SEPM already has. You yourself clearly state that in the next paragraph:

SEPM can only give out delta files from definition versions that it has

This means there should be no conflict between different definitions unless the client is instructed to download from another source such as directly from Symantec or gets a manual update.

I believe that his setup will work as he imagines based on the two extract from your post. Sorry, I can't test that though.

 

Please mark the post that best solves your problem as the answer to this thread.
Elisha's picture

Will the 30 contents give me only 10 days of defitinions even when my console is scheduled to only download ONCE a day, let´s say every day at 12:00 AM?

No.  If you only run LU once a day on your SEPM then you don't even have all the updates for a single day.  Which means your SEPM cannot guarantee to hand out delta files if the client is only one day old.

bennacchio's picture

I am sorry Elisha, but now you got me really confused in here, lol..

Let´s suppose that my console did the LU at 12AM (it will get at least 3 more new content knowing that the last time the console checked on Symantec website was 24h ago right?)  and during day time Symantec releases 2 more new definitions. When my SEP client goes online let´s say only in the afternoon it will be 3 contents old (because of the whole last day) plus these 2 contents for today that my Console did not get yet, (but my SEPclient don´t even know about these 2 last contents because it does not have connection to liveupdate). So you are telling me that these 3 contents related to the whole last day won´t be delivered as delta, are you sure?  

 tks

Rafeeq's picture

Ideal to set manager to get updates every 4 hours.

 

bennacchio's picture

I know guys, the best practise should be 4 in 4 but even so i need to undertand how it works (as the question in my last post) because in some particular customers, depending on the enviroment they want sep clients updating definitions only once a day specially because we are talking about many many breach offices (more than 600 locations) sometimes links with only 64kbps (believe me it´s hell) and no local servers.

thanks ... 

Elisha's picture

So you are telling me that these 3 contents related to the whole last day won´t be delivered as delta, are you sure?

Not exactly.

I am saying that if a client gets a version of content that the SEPM does not have then later when the client needs a content revision from SEPM it cannot get a delta file.  SEPM can only hand out a delta file if the client is currently using a content revision that SEPM also has.  Since clients can get content from multiple places it is important to ensure that SEPM has all the content revisions so that it is able to build delta files for the clients.

but my SEPclient don´t even know about these 2 last contents because it does not have connection to liveupdate

If your clients are only getting content from SEPM and GUP then only clients with very old content revisions would have content revisions that SEPM did not have.  However this also means that any client that is not connected to SEPM would not get updates.  For example when a user takes his laptop home the client would not get updated content.

SOLUTION
bennacchio's picture

Perfect Elisha, now its crystal clear...

Thanks so much for the info and for the patience

Best Regards,