Endpoint Protection

My setup is as follows - SEPM MR4, One Site, two management servers in two different locations, sql server 2005 database in one of the two locations, WAN Link 4mbit that connects the two locations.

Problem #1: I have configured in Admin-Servers-Local Site-Properties-Liveupdate-Disk space management for downloads--> keep 10 content revisions

Result #1: in C:\Program Files\Common Files\Symantec Shared\SymcData\sesmvirdef32 in which from what I read the definitions are stored only two revisions every time available.

Problem #2:  I have configured in Admin-Servers-Local Site-Properties-Liveupdate-Download Schedule --> every one hour

Result #2: First Management server seems to update every one hour but the first and second management server get the updates in completely different time stamps

a. second management server get rev23 on 03:39am 03/04.2009 and the first management server on 04:58am same date

b.second management server get rev41 on 12:52pm 03/04/2009 and the first management server on 09:53am same date

What goes on here? Why configure liveupdate on the console for the site in one place and see only the first management server in the console logs get the updates and discover the second server getting the updates in completely irrelevant times.

How does the second server get the updates (is not discused anywhere I looked)

a. from the first management server?

b. from sql server?

c. independetly? (in this case where can i see the logs about the updates and where do i customize the frequency?)

I'd appreciate any help from anyone.

1) revisions are in %SEPM%\Inetpub\content\

C:\Program Files\Common Files\Symantec Shared\SymcData\sesmvirdef32 - working directory

2) liveupdate runs one time only on one server - SEPMs choose on which one (take a look on logs in Admin->servers)

your SEPMs have one database - and definitions which one of SEPMs download are stored in the DB - so second SEPM get definitions from DB

but it is not very good schema  -  i suggest you to install SEPMs with their own DB and make replication between them - it will decrease traffic between SEPM and DB

Thanks for the information. Two questions:

Whats the meaning of working directory?

If it gets updates from DB (I checked the contents of Inetpub and it has the same contents on both servers with 2 minutes apart creation dates-times which is logical) why does the working directories of the two servers are different in content and even when they have the same conent they have a LARGE time difference which goes either way --> either the first has them 2 hour before the second or the second has the 4 hours before the first.

It would be logical since they have the same date-times in the inetpub\content folder to have the same in the working directory also isnt it???