Endpoint SWAT: Protect the Endpoint Community

Hi all.  A quick Google search for things like "importpackage outbox" is enough to return several results on this issue.  The newest info I can find was in 2012 though.  The information seems to indicate that a problematic migration or upgrade occured, causing files int his path not to truncate.  Well, I haven't upgraded or attempted to upgrade in many months, and I'm still seeing this folder grow all on its own. 

For quick reference, the full path is C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\outbox\ImportPackage

The contents of this folder date back to April 2013, and this is July 2014 now.  Not every day, but nearly daily there is at least one new file there which seems to be trending larger and larger over time.  IN April 2013 the files were around 250MB, now in July 2014 they're all around 400MB.  On July 28 a couple days ago, about 4 or 5 of these 400MB files were created 

The workaround I've seen thus far is to stop the SEP manager and database services, manually clean out this folder, and restart those services.  I'll do that but does anybody know what causes this?  I'll continue reading my Googled search results as well. 

Thank you. 

I believe this was a bug, what version you running?

thats a bug , I belive its still under investigation. manual procedure is to delete the content inside these folders as it stores all the previous defs in here

The Symantec Endpoint Protection Manager \data\outbox\Importpackage folder uses excessive disk space

http://www.symantec.com/business/support/index?page=content&id=TECH171966

Thanks guys.  Glad to know it's actively on the list of bugs.  Still, it's a 3 year bug, maybe time to fix it? :) I know Symantec has gone through a lot of organizational problems in the past while though. 

On both installations I'm watching this issue on I see 12.1.4013.4013 . Come to think of it I think I had downloaded MP1 and haven't applied it.  Would be great if the problem were fixed in that patch :) I'll be happy to give myself a slap on the wrist for asking bug-related questiosn without having been fully patched, IF this one fixes it ;)

BTW, should I keep the latest file in there and just delete the older, or can I get rid of all contents?  

Sorry Brian I marked Rafeeq's as the answer but really I'd have preferred splitting the answer.  Maybe I'm thinking Symantec dos this when it's really the MS technet forums.  There's not even a "mark as helpful" button!  I could alwyas mark as offensive =P just kidding. 

You can mark split solutions :)

I believe you need to remove the asolution thats marked and from there you can do the split solution

Hi,

It was a bug and fixed in SEP 12.1 RU3 release. 

High disk space is consumed by C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\Importpackage

Fix ID: 2914951/3118490

Symptom: Hard drive space on the Symantec Endpoint Protection Manager server is running low due to files building up in C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\Importpackage.

Solution: Added an additional attempt to forcefully remove the files in the import folder if the first delete fails.

New fixes and features in Symantec Endpoint Protection 12.1.3

http://www.symantec.com/docs/TECH206828

Unfortunately it doesn't appear to be fixed.  Provided I properly understand what to expect in that importpackages folder. 

I'm running 12.1.4013.4013 in three unrelated environments and having the problem in every case.  One location had files going back to April 2013 and were taking up over 110GB.  Another, I see only files back to July 4 2014 so less than a month, and there are maybe 5 or 6 large 300-400MB files, and a handful of smaller 5MB sized ones.  Still, there are many files and if I understand the problem resolution correctly, the idea is ulti8mately not to have any files in there since the solution advocates removing all contents.  

So does this mean we have to reescalate the issue?  It is clearly not fixed in RU3 if all of my unrelated deployments are all having the problem.  All are using the embedded db as well. 

Mixit, you can find "Was this post helpful to you" button just above the Comments section.

Hi,

I will suggest to upgrade to SEP 12.1 RU4 MP1a to check if it helps.

Or else reescalate the issue.

Sorry I seem to be confusing myself - when I get the Symantec email notifvications about a thread being updated I forgot I was involved with two of these on the same subject.  I'll be updating to MP1b soon on all SEPM's so we'll see. 

I don't really what to spend a lot of time escalating this.  The last time I called in on an issue that needed to be escalated I had to jump through a lot of time-consuming 1st-level tech support hoops when all it really required was that they set up a few systems in a lab and see for themselves.  The techs kept trying to fix the issue on my end even though it wa clear to anybody with experience that this was not a solvable problem via workarounds.  And it had nothing to do with my environment because in that situation as it is now, I was seeing the issue at all locations, with all SEP deployments and in some cases had built up entirely new deployments just to test this issue, with no change to the problem.  I was clear in explaining that too.  Ultimately I just didn't bother continueing with that process because as nice as the tech support people were, they clearly weren't getting the message that they simply needed to escalate the problem.  I understand ther's a need to verify things before escalating, but there is also a point where techs need to take the blinders off and look at the bigger picture, something 1st level techs are often not able to do due to inexperience (I managed teams in a call center so I know how this goes).  So since then I'm inclinded to hope somebody else is willing to spend a lot of time on the issue as I'm certain I"m not the only person with this (or the previous issue) :)

Ouch, big paragraph, sorry about that!