Endpoint Protection

We've had a couple of issues with SEPM 12.1.4023 performance issues - or what appear to be performance issues.

1. The SEPM native web site ceases to work and only a system reboot seems to resolve this
2. Notifications pertaining to virus outbreaks and remediations are sent out days later, often 3+ days after the malware was contained and the infected file deleted

SEPM in our enterprise is running on VMware guest, Server 2012 R2 Datacenter, 8GM RAM.

Any ideas / thoughts are much appreciated...

-SEPM User

What DB are you using, SQL or embedded?

The most common bottleneck to SEPM performance is disk I/O.  I'd recommend reviewing the VM Host performance data to see if you're hitting any Disk I/O throughput thresholds.

If so, then moving to an off-box SQL DB ("Thumbs Up" Brian ) will likely free up some disk access.  There are other options, but best check out the host first.

How many are your SEP clients? Also what application or services are running on your VM host, because eventhough you are running on a VM guest and your server was properly size up, trafic was basically travelling on single network to your VM host that might cause bottleneck (as mentioned by SMLatCST).

In addition for you SEPM sizing:

The Shared Insight Cache Server runs on a dedicated server or virtual machine and requires the

following:

Windows Server 2008 32 or 64 bit, 64 bit is recommended for best performance

-30 GB of total disk space

-CPU requirements

For less than 100 clients a single core CPU is acceptable

For more than 100 clients two CPU cores are recommended

-RAM requirements are dependent on the number of clients in the environment

2 GB for less than 100 clients.

4 GB for 100-1000 clients.

8 GB for over 1000 clients.

Best Regards,

Hello,

Is there any update regarding this issue? Does the comments about answer the performance issue?