Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SEM5 Database growth trend

Created: 22 May 2013 | 9 comments

Since about the time we started deploying SEP 12.1 to clients our SEP database has shown much faster growth than previously. We ran SEPMs on 12.1 RU1 for 7 months without any unusual growth. Only after we started deploying 12.1 RU1 clients to W7 x64 do we see this trend.

We run weekly re-index and truncate transaction log already.

Anyone else noticed this?

Operating Systems:

Comments 9 CommentsJump to latest comment

.Brian's picture

Is this the sem5.log file or the db itself?

There was a known in ru1 which causes the sem5.log file to grow and never purge itself.

How much logging do you have enabled for clients? How many content revisions kept?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Mithun Sanghavi's picture

Hello,

I would recommend you to please migrate the SEPM and SEP clients to the Latest version of SEP 12.1 RU2 and above.

The issue you are facing was a known issue in SEP 12.1 RU1.

Check these Articles:

Symantec Endpoint Protection Manager (SEPM) Database Transaction Log (sem5.log) Consumes Hard Drive Space in SEP SBE 12.1 RU1

http://www.symantec.com/docs/TECH178718

Shrink the Symantec Endpoint Protection Manager 12.1 embedded database

https://www-secure.symantec.com/connect/downloads/shrink-symantec-endpoint-protection-manager-121-embedded-database

How to periodically free up the space used by the sem5.log in EPSBE 12.1 RU1

https://www-secure.symantec.com/connect/articles/how-periodically-free-space-used-sem5log-epsbe-121-ru1

Hope this helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

Serengeti's picture

according to my Symantec TAM the issue has nothing to do with sem5.log which is the issue fixed in RU2. We use separate SQL 2008 databases for our SEP sites, not the embedded database. I should have specified that.

pete_4u2002's picture

is there any change in log retention?

have you enabled application monitirng?

AjinBabu's picture

Hi, 

How many clients on your Network? 

As Pete Said any change in log retention & is Application monitoring enabled?

Regards

Ajin

Serengeti's picture

no increase in clients and no changes to log retention. The database started to grow around the time that we started deploying SEP 12.1 RU1. Would be interested if anyone else has seen the SQL sem5 datbase grow since upgrading from SEP11 to SEP 12.1. The transaction log basically ran out of space causing a crash. We have assigned more space. SCANS table looks to be growing steadily. We are using SONAR, Download Insight etc - the features which SEP11 does not have. Not using application monitoring as far as I know.

Mithun Sanghavi's picture

Hello,

Since you have SQL Database, you may like to check these Articles:

Symantec Endpoint Protection Manager (SEPM) SQL Database size (autogrowth)

http://www.symantec.com/docs/TECH184770

Could not allocate space for object 'dbo.BINARY_FILE' in database 'SEM5' because the 'FG_CONTENT' filegroup is full.

http://www.symantec.com/docs/TECH106075

Changing the log settings to reduce the size of the database

http://www.symantec.com/business/support/index?page=content&id=TECH105238

How to quickly purge the SEPM log tables on a SQL server

http://www.symantec.com/business/support/index?page=content&id=TECH132880

Maintaining the database

http://www.symantec.com/docs/HOWTO55337

Disk Space Management procedures for the Symantec Endpoint Protection Manager

http://www.symantec.com/docs/TECH96214

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

Chetan Savade's picture
Hi,
 
Go into the Symantec Endpoint Protection Manager (SEPM) and select Admin > Servers. Right-click on Local Site and select Edit Properties. One of the tabs will be Log Settings. This tab allows the Administrator to adjust how many log entries are kept and how long they are kept.
 
The Database tab also has settings that the Administrator can change and adjust pertaining to the purging of events from within the database.
 
The Client Log Settings determine which logs are uploaded to the manager from the client. This can be adjusted in the SEPM by going to the Clients section, choosing the Policies tab, and choosing Client Log Settings from under Settings. 
 
Any adjustments in these sections will either make the database larger or smaller, depending on which changes are made.
 
Changing the log settings to reduce the size of the database
 
http://www.symantec.com/business/support/index?page=content&id=TECH105238
 
How to quickly purge the SEPM log tables on a SQL server
 
http://www.symantec.com/business/support/index?page=content&id=TECH132880
 
Maintaining the database
 
http://www.symantec.com/docs/HOWTO55337
 
Disk Space Management procedures for the Symantec Endpoint Protection Manager
 
http://www.symantec.com/docs/TECH96214
 
Shrink the Symantec Endpoint Protection Manager 12.1 embedded database
 
https://www-secure.symantec.com/connect/downloads/shrink-symantec-endpoint-protection-manager-121-embedded-database
 
How to periodically free up the space used by the sem5.log in EPSBE 12.1 RU1
 
https://www-secure.symantec.com/connect/articles/how-periodically-free-space-used-sem5log-epsbe-121-ru1
 

Symantec Endpoint Protection Manager (SEPM) SQL Database size (autogrowth)

http://www.symantec.com/docs/TECH184770

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

SMLatCST's picture

Following the spirit of the thread, I've personally not noticed the DB size ramp up unexpectedly while upgrading clients from 11.* to 12.1.

The only thing I can think of (off the top if my head) that would generate this sort of behaviour, is if you added the FW component to your endpoints when upgrading.  The Traffic and Packet logs generated by the FW component have the potential to become quite large sometimes (depending on the FW Rules), which may translate into expected DB growth if it wasn't used before.

Other than that, the SONAR component (in working in realtime) may also generate more log entries than the old TruScan technology, but I wouldn't expect it to make a noticable difference to the DB size.

On the subject of your SQL transaction log, while this won't address why it's growing so much, it should be of some benefit to schedule a more regular truncation task.  As a baseline, you may want to mirror the SEPM's default truncate schedule of every 4 hours.