Endpoint Protection

Greetings all.

Does anybody know of a way in which we can remove the Mac install package as an available option from within SEPM?

We have no Macs, along with no intention of ever having any so see this as a waste of drive space and bandwidth during updates for it.

Thanks in advance,
e-charge.

Right click the package and select Delete

However, be advised that if it is the latest packge, SEPM will not let you delete it.

Hello,

Delete the Package... how?

Check the Below:

1) You could either Delete the Mac Package from SEPM as shown below

OR

2) Check the package for the MAC under

C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\ClientPackages\

and delete the package from there.

There are no updates hosted for the Mac in the SEPM, so you do not have to worry about bandwidth usage for it.

I don't know if the SEPM will allow you to remove the most recent Mac install package from within the SEPM, and I don't know what the effect is of manually removing the file, so I would not recommend doing it. (It is not a particularly large file, anyway, only about 115 MB.)

sandra

Thanks Mithun but it won't allow me to delete the current release of the package from within SEPM and deleting the package folder manually is futile as it's recreated upon a service restart. Tried both of those actions before posting.

Thanks for the info about Mac updates Sandra as I was working on assumption in my comment. I know it's not a huge file but I'm just trying to claw back some drive space after having most of it eaten by the embedded database. Whilst I'm on the subject: do you know of a way to reduce that at all?

I have one site with only 3 clients but the database is 2GB in size. I can't believe that's necessary.

Thanks again for your help people.
e-charge.

yes, u r right, you wont be able to delete it....

the size should be related to the virus defs stored in the content folder

admin

servers

local site

make the content revisions to 3 if its 10, that should give u lot of space.

I'd already done that. The default setting is three revisions and I've reduced it to one. My Mac install package folder is only around 80MB but as I said, clawing back an' all that. It would be nice to have the option to not accommodate install packages for systems not implemented.

Thanks for your suggestion Rafeeq. Any tips re: my database query?

2 GB sounds about right. The system requirements document indicates to allow 4 GB for the database.

System requirements for Symantec Endpoint Protection and Symantec Network Access Control 11.0.6
http://www.symantec.com/docs/TECH131642

(I definitely don't recommend keeping revisions at 1, because that means your clients out of touch for more than a day will always be asking for a full set of definitions, which is significantly larger than the delta package.)

sandra

Thanks for your input Sandra.

I'm assuming that a delta package is an incremental download of new definitions adding to the full set which already exists on the SEPM machine. Is that correct?
So for example: If I set my revisions count to 3, I'll be retaining a single, full definition set with 2 deltas, and my clients will only EVER download deltas from the SEPM as opposed to full sets (assuming they retain contact with the SEPM within 2 days). Is that how it works?

I appreciate that the virus def files are constantly growing but at present, what sort of rough file size difference are we looking at between a full set and a delta?

Thanks again,
e-charge.

No, it will be 3 full sets. The SEPM then looks at what the client has, calculates the difference necessary to get that client from where it is to where it needs to be, and sends it that difference (or delta) file. That delta file is usually much, much smaller than the full package.

In looking in my own SEPM installation, in [SEPM install folder]\Inetpub\content\{C60D...} (32-bit definitions), I see the following:

full.zip: 115,403 KB (~115 MB)
xdelta....dax (the delta file created for my SEPM's client, which updates as soon as the SEPM does): 440 KB

I had my SEPM shut down for 10 days while I was out of office. My revisions went from the 21st to the 31st. The delta file built between those two for my SEPM's client was 2.6 MB.

The delta file can vary in size depending on the amount of difference, but as you can see, the delta is very much preferable to the full.zip in terms of size.

Since there are three certified definition releases per day, keeping three revisions essentially means a day's worth if the SEPM has the default LiveUpdate schedule of every 4 hours. People turn off their computers over the weekend, and suddenly Monday morning the WAN is flooded with full definition packages.

sandra

Many thanks for your detailed explanation Sandra, it's very helpful and much appreciated.

I hope you don't mind me being cheeky and posing another question but you seem quite savvy with SEP and will probably be able to answer this with no effort.

All of my servers with SEP installed experience an event log error of "Secars started!". It's an Informational event with an ID of 1 in the application log and in my case, occurs at 04:00 am every day.

The reason I'm curious is that it's the only other event which kicks off at the same time every day as another event on my servers, this one being "A process serving application pool 'DefaultAppPool' exceeded time limits during shut down".

There's nothing else scheduled to run at this time and no other events appear at this time either so I'm assuming from this that the two are related in some way.

Any help would be much appreciated.

e-charge.

De nada!

Glad to see a new thread for your question :)

sandra

Indeed, I thought I had better stick to protocol and keep people happy.

So is it pretty definitive then that there's no way to destroy the Mac package in the SEPM?
*Hovering finger over the "Mark As Solution" button.*

e-charge.

Yes. As I mentioned in my first post, you cannot delete the initial package from SEPM. For whatever reason it seems to be hardcoded to not allow it.