Endpoint Protection

Hi 

My problem abouth SEP manager update criteria ( if the client has been offline more than 15 days, it will download a full SEP 12 Virus definaiton file this file around 400 MB  we have many user like this. Same user can't download full package ang giving the eror for update status.

I want to learn Update criterrias SEPM 

When need user full package? How it is the change tis settings.

Thanks greatly!

Please read through these KB articles:

When will a client download a full definition set from a Symantec Endpoint Protection Manager or Group Update Provider?

Preventing Symantec Endpoint Protection (SEP) Clients from receiving FULL Antivirus/Antispyware definition packages from a patched Symantec Endpoint Protection Manager (SEPM)

Hi Brain 

I have main location one SEPM and many child location installed GUP.

For example our employe 15 days don'f come to work and his laptop didn't connect our network, after 15 days people is coming the office and connect to our network. This laptop is request the full pack update file to SEPM. I don't like this becouse one file is 400 MB and many client is try to download on SEPM our network  band is oweviev. 

I want to user after 15 days connect to our network install update packet loss 15 days on GUP. I don't want to request full pack.  Do you know any configuration.

Thanks.

How much content are you keeping on the SEPM? Remember defs are released 3x day Monday-Friday and 1x a day Saturday/Sunday.

So you need to keep at least 17 content revisions for one week. For 15 days you're looking at at least 51 content revisions to be kept.

Agree with Brian.

If you want to cover 30 days, the SEPM should save about 90 content versions. You can adjust this number on the SEPM under Admin > Servers > Local Site > Edit Site Properties > LiveUpdate > Disk Space Management for Downloads.

Since SEP 12.1.5, there is no disk space penalty anymore if you want to save a lot of content versions.

IF your clients are at 12.1.6 and the SEPM is not able to provide small content files (delta files), it's possible to let the clients download delta files from a LiveUpdate Server (in most cases from the internet from Symantec). You can allow this in the LiveUpdate policy: Clients > [Group] > Policies > LiveUpdate Policy > Advanced settings > Let client download smaller packages from a LiveUpdate server.

From your comment I understand that you have kept about 40 revision in your SEPM. which is very less and SEPM can store upto 180 Revisions. you will need to retain about 75 to 80 revisions in an ideal senario so that even if a user comes back after 1 month his machine will download just the delta roughly about 5 to 15 MB. 

Content Storage Optimization feature:

As part of the upgrade to SEPM 12.1 RU5, the SEPM converts all of the content from full definitions to delta definitions. This process is resource intensive and may take an extended period of time. After this process is completed, the SEPM will use significantly less disk space.

In a typical enterprise setup where 30 content revisions stored, the SEPM upgrade process must reduce 55GB of full content to under 2GB of delta content. This process requires significant resources to complete and is impacted by the performance of any available CPUs, CPU cores (physical/logical/hyperthreading), memory, and disks (I/O). On a server that performs multiple roles, stores larger numbers of content, or is otherwise resource constrained, this process may take a longer duration to complete.

Refer this article to find more info: The LiveUpdate content optimization and content storage space optimization steps take a long time to complete when upgrading to Symantec Endpoint Protection Manager 12.1 RU5

http://www.symantec.com/docs/TECH224055

so if you are using SEPM version 12.1.5 or above I would suggest you to increase the content retention to 90 or above as per your wish so that the client will download only delta defition and you wouldn't have to worry about the disk space on the SEPM or the network bandwidth. 

here is the best practices.

Best Practices for configuring the number of content revisions to keep in Symantec Endpoint Protection Manager

hi PraveenAyappan yes you understand correct. 

Our system configred 30 versions is keeped on GUP. I installed test environment for check. I will configred 80 versions keept and disk space is 30GB.

I read document thanks for information. 

Correct. For the amount of revisions you want to keep this will need to be increased.

once you change the content revision to 80 you will for sure see visible change.