Video Screencast Help

Pull mode vs push mode

Created: 01 Feb 2012 • Updated: 10 Feb 2012 | 6 comments
This issue has been solved. See solution.


Regarding which mode to use for different types of clients, I expect this to be correct:

PUSH MODE for servers and other clients that are online always or most of the time

PULL MODE for PC's and workstations that are turned on and off by users.

I'm grateful for comments on this :-)

Comments 6 CommentsJump to latest comment

SameerU's picture

Pull mode

In pull mode, the client connects to the manager according to the heartbeat frequency. This procedure repeats indefinitely. The number of clients that can be supported in pull mode depend on the following conditions:

Push mode

In push mode, the client establishes a persistent TCP connection to the server. If a client cannot connect to the management server, it retries periodically, depending on the heartbeat frequency. The following conditions apply to push-mode communication:


dasomm's picture

Thanks for the feedback, but I need some info on when using which method.

SMLatCST's picture

..and the role they play in your environment.

As Sameer has stated, in 'Push' mode, the SEP Clients maintain a constant connection to the SEPM.  This means they are immediately aware of updates the moment the SEPM downloads them, and also receive commands from the SEPM immediately (ie "scan now").

If this level of response is required for some of your servers that are running SEP Clients, then switch these to 'Push' mode.

For everything else, use 'Pull' mode.

Don't forget, Symantec best practices state environments with >1000 clients should use 'Pull' mode with heartbeat intervals of at least 30mins, preferably 1 hour.

w-d's picture

Pull mode is good also for the machines in remote sites and in case the SEPM is installed on non-server operating system (eg. Windows XP)

Chetan Savade's picture


Push mode

The client establishes a constant HTTP connection to the server. Whenever a change occurs with the server status, it notifies the client immediately.

Pull mode

The client connects to the server periodically, depending on the frequency of the heartbeat setting. The client checks the status of the server when it connects.

Because of the constant connection, push mode requires a large network bandwidth. Most of the time you can set up clients in pull mode.

What is the difference between Push and Pull modes when downloading policies and content from the management server? --> Clients that use the Push mode download policies and content as soon as they become available. On push mode an open connection is kept so that the manager can contact the client immediately when data is available. Clients that use the Pull mode download policies and content based on the Heartbeat interval setting, which is set to 5 minutes by default. Because of the greater network bandwidth that is used with the push mode, it is recommended more for small and medium-sized networks.                                                                                  

Configuring push mode or pull mode to update client policies and content

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<