Endpoint Protection

I have Endpoint Manager and Live Update Administrator running on the same server (servers are limited) but it seems recently the server has been getting overloaded.  How much resources should SEPM or LUA take?

 

SemSvc is taking 667M of Ram

Tomcat5 is taking 200M

dbsrv9 at 151M

and 11 Postgres.exe instances runing around the 40M mark

 

is this normal? It seems really high...

 

note: not a fan of picking the product and topics before i can post

How many clients are you supporting with that lot?

With my rough maths.. I'm guessing you have either a dual or quad core box?

we have 400 computers, currently 200are reporting in to the server due to what was mentioned here (https://www-secure.symantec.com/connect/forums/server-showing-offline-client)

This server is the Management server and primary Live Update Server, we have 1 DR server mirrored incase it goes down (dont ask why it didnt work last time)  The Management server has the 200 clients i mentioned, though previously it had closer to 380, it distributes LiveUpdates to 19 other Distribution Centers (via Push over tcpip) so we can try to keep control over what is being downloaded when and where.

For the hardware:

1 3.2Ghz Pentium4 CPU, 4GB of Ram, 320 GB harddrive

Prior to the rebuild we got close to 20 notifications per day reporting overloaded (80+ Upload failures) now we're getting about 5-6 as i add the clients back.   I've checked the timestamp on the reports and it doens't seem to reflect back on any set distribution schedule or the normal boot times of our PCs.   I tried changing the communication settings to pull every 2hrs instead of every 20 minutes but that didnt seem to help.

Well, the memory usage for tomcat, dbsrv9 and postgresql is about right, but thats quite a large number of PGS processes (I normally see one or two per CPU).  One thing that might be worth trying (to eliminate everything else) is to temporarily move the LUA server to your DR box and run it from there for a week or so and see if things pick up.

The semsrv process does seem to be running a little high - what options did you choose at install time in terms of number of computers, etc.?

Are you willing to explore your configuration a little more?  If you have 19 distribution centers, I'm assuming you therefore have 19 offices with machines that are turned on a large percentage of the time?  What sort of bandwidth do those sites have avaialable and in general, how up to date are your clients with their content/defs?  This is potentially a good candidate for using the GUP...

I'll look up the options, but i believe i chose the 500-1000 range because we expect growth in the near future, though I know it is using the embedded database.

 

I'll see if I can push the central LUA server off to another location for a short time for testing, I think I have one I can convert.

 

We use the 19 distribution centers (one for each office) to minimize the impact on the network the clients generate and to offer tighter control over what is being downloaded and when.  Each office has about 20 clients (the main office has the bulk of the clients) that are on about 8hrs of the day, so we would rather have 1 server download the definitions and replay them locally than 20 clients connecting back to corporate.   Not an ideal situation but its a mimic or as best of a translation as we could come up with migrating from out SAV.

 

the bandwidth to the offices are somewhat limited due in large part to backups and other traffic being run throughout the day by other departments, we aim to keep all clients within 3 versions of the latest definitions. I would love to have them all on the latest at all times but right now thats not feasible.  The current LU structure pushes the definitions twice a day (morning and evening) to keep them as up to date as we can.

 

Thanks

Looks like my documentation was out of date somewhat, the Systems Administrator added a CPU to the server a few months back without telling me so it is a Dual CPU (2 P4 3.2Ghz)

bump

Hi. What's the randomization time set to?

 I am sorry, but whats randomization time and its effects on SEPM. 

Randomization is SEPs way of increasing the chances for clients to connect successfully and avoid queueing
Assuming that there is no randomization and all your clients system time is syncronized and they're set to update at the exact same time. That would affect your network bandwidth and not all clients will be able to connect.
Check the server - do a netstat. Count the number of established connections and the total connections.