Video Screencast Help

Randomization

Created: 12 Nov 2012 | 5 comments

Hows does randomization work?

If I set the heartbeat to 60 minutes and randomization to 120 minutes, what does that mean?  Is randomization +- 2 hours, or is it just a window of 0 to 120 minute delay for downloading definitions.  

What happens if the machine is turned off before that randomization window, does it automatically download the definitions immediately the next day, or does it recompute a new 120 minute randomization window?

Comments 5 CommentsJump to latest comment

Rafeeq's picture

Heartbeat is for communication between manager and client.

when they talk to manager, they download policies and udpates

if youa re using liveupdate administrator.

and you dont want all your clients to talke to manager , all at once

you select a randomization minute...

they will take within that time period

======

as explained from the below link

Specifies a randomization option. You can stagger the updates, plus or minus the value that is specified, to minimize the effect on network traffic. By default, Symantec Endpoint Protection randomizes the LiveUpdate sessions to minimize bandwidth spikes

http://www.symantec.com/business/support/index?page=content&id=TECH178257&profileURL=https%3A%2F%2Fsymaccount-profile.symantec.com%2FSSO%2Findex.jsp%3FssoID%3D1352754109577gp5jYZ857PuGKws3FK21O94q7EC65jA6njN44

Brɨan's picture

Have a look at this and the corresponding KB articles within:

About randomization of simultaneous content downloads

http://www.symantec.com/business/support/index?page=content&id=HOWTO80889

It should +/- 2 hours than

If machine is turned off before window, it should recompute when turned back on

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

greg12's picture

If I set the heartbeat to 60 minutes and randomization to 120 minutes, what does that mean?  Is randomization +- 2 hours, or is it just a window of 0 to 120 minute delay for downloading definitions.

As soom as the clients discover a new content revision on the SEPM, they start a window of (in your case) 120 minutes. In this time window a random point in time is chosen, e.g. 55 minutes. So it's your second alternative. In a worst case scenario, a client will get the fresh content almost three hours after the SEPM was updated.

It's even possible to detect this point in time in sylink log files. It's described here:

Understanding how the Randomization of content updates are reflected in Sylink logs

http://www.symantec.com/docs/TECH131439

ed16's picture

Our normal hearbeat is set to 60 minutes.  What is a recommended randomization time for 10,000 machines reporting to 2 SEPM servers?

greg12's picture

For me 120 minutes seem to be a little bit high ... If you have a network with decent bandwidth and if you are saving a lot of content revisions on the SEPM (so it's able to generate small delta files over a long period of time), you should decrease the randomization time to, say, 30 minutes or even less.

The number of content revisions saved on the SEPMs may be even more important for your content download perfermance than the hearbeat or the randomization time. For example, as Symantec publishes about 3 content revisions per day, for 14 days you could save 42 (14*3) content revisions. So the network won't be stressed too much because most of the clients (those having content not older than 14 days) are pulling the delta files (200KB - 3-4 MB ) instead of the full content revision (>200MB).

See here:

Best Practices for configuring the number of content revisions to keep in Symantec Endpoint Protection Manager

http://www.symantec.com/docs/TECH92225

It's not perfectly answering your questions, but this document may help you as well:

Sizing and Scalability Best Practices

http://www.symantec.com/docs/DOC4448