Endpoint Protection

I'm building a new SEPM enviornment.  Currently, I have SEPM installed on one drive (C:\) and the database on a second mounted drive.  I'm trying to figured out why the database in the test enviornment is larger than our production enviornment.  The test enviornment has only a handful of clients pointing to the SEPM.  The old enviornment's content revisions are set to 3.  The new enviornment is set to 42 revisions.  Also in the new enviornment the C drive is currently running out of space.

I did find some items on the C drive that I could delete (SEPM download, SEP client install package).  That freed up about 2GB or so of space.  That was 2 days ago and now the drive is once again out of space. 

I'm just trying to figure out why SEPM is utilizing so much hard drive space.  Any help anyone can offer would be greatly appreciated.

What version? SQL server or embedded DB?

Here are some helpful links and helpful article:

http://www.symantec.com/docs/TECH155046

https://www-secure.symantec.com/connect/articles/symantec-endpoint-protection-manager-121-database-using-high-amount-hard-drive-space

Hi Brian, the database is embedded.

What version? There was an issue in RU1 which casued the sem5.log file to grow uncontrollably.

version 12.1.3001.165

I've changed the content revisions down to 10 from 42.  Is there a way to go in and force the database purge or is it best to let it occur on its own?  If it occurs on its own, how soon can I expect that to take place?

HI

Do you have maintainence of database configured ?

Regards

Hello,

Please check these threads, Hope these will help you.

https://www-secure.symantec.com/connect/forums/sepm-embedded-database-log-file-size-large

https://www-secure.symantec.com/connect/downloads/shrink-symantec-endpoint-protection-manager-121-embedded-database

https://www-secure.symantec.com/connect/articles/symantec-endpoint-protection-manager-121-database-using-high-amount-hard-drive-space

SEPM database transaction log (sem5.log)  taking lots of space.

http://www.symantec.com/business/support/index?page=content&id=TECH178718

Hi,

Configuring the disk space that is used for LiveUpdate downloads

If you select 500 or fewer clients during the Symantec Endpoint Protection Manager installation, then by default Symantec Endpoint Protection Manager stores three LiveUpdate content revisions for each content type. If you select 500 to 1,000 clients, Symantec Endpoint Protection Manager stores 10 revisions by default. If you select more than 1,000 clients, then Symantec Endpoint Protection Manager stores 30 revisions by default. For example, if you select 500 or fewer clients, the Symantec Endpoint Protection Manager stores three revisions.

To reduce disk space and database size, you can reduce the number of content revisions that are kept on the server. You should be aware, however, that reducing the number of content revisions also affects a server's ability to make deltas between content updates. A delta is an update that contains only the incremental changes since the last full content revision. Delta files are typically much smaller than full update files.

The more content revisions that you keep, the greater the ability of the server to create deltas between content revisions. The number of content revisions that you keep is particularly important if you have some client computers that are offline for days at a time. Symantec typically releases 3 to 4 virus and spyware content revisions per day. Keeping at least 10 revisions ensures that the computers that disconnected on a Friday can use a delta to update on Monday morning. Delta updates take less time and bandwidth than downloading a full content revision.

To configure the disk space used for LiveUpdate downloads

1.    In the console, click Admin.

2.    Click Servers and select the site that you want to configure.

3.    Under Tasks, click Edit Site Properties, and then click LiveUpdate.

4.    Under Disk Space Management for Downloads, type the number of content downloads that you want to store.

5.    If you want to reduce the amount of disk space used, uncheck the Store client packages unzipped to provide better network performance for upgrades option.

6.    Click OK.

Regards

Ajin

Hi

Can you please update on the provided solution

Regards

Hello,

you answer your questions by yourself, 42 def revisions are x14 bigger than 3 def revisions.

Just run the LiveUpdate from the SEPM console to trigger the content purge.

Unfortunately, the drive is full with 0 space left.  I changed the revisions yesterday from 42 to 10, but SEPM has not purged any content and the drive is still full.  Can you tell me where I can go in and manually delete these revisions?

AS Beppe mentioned, running a LiveUpdate from the SEPM Console will cause it to purge unnecessary defs.

For your own reference, they are stored in "\Program Files\Symantec\Symantec Endpoint Protection Manager\Inetpub\content".  The largest ones will be the those named below (the virus defs folders):

I've attached a screen shot.  Just to clarify, I should NOT delete these folders and just go in and delete the contents? 

Yeah, if you look inside the folders I mentioned (the largest ones), you should see subfolders named similarly to below:

130919017
130919023

According to the article I linked, you should be alright to delete these.  The folder names are dates and revisions numbers, so pick the older ones.  Folder naming structure appears to be YYMMDDRRR

That worked, thank you!