Endpoint Protection

 View Only
  • 1.  SEPM is not getting latest virus definitions

    Posted May 15, 2014 08:28 AM

    SEPM has an older version of the virus and malware definitions. I have tried to Donwload liveupdate content from the admin -> servers tab. Virus and malware defs are not able to download and the other stuff says no updates needed. I had tried a jdb file and that didn't work. I tried clearing old corrupt defs and that didn't help either. The liveupdate version is the correct version. There is enough free space on the server. The only thing I have to go on is there are multiple SQL server errors in the windows event logs.

     

    EventID 1105

    Could not allocate space for object 'dbo.BINARY_FILE' in database 'sem5' because the 'FG_CONTENT' filegroup is full. Create disk space by deleting unneeded files, dropping objects in the filegroup, adding additional files to the filegroup, or setting autogrowth on for existing files in the filegroup.

     

    EventID 1824

    CREATE DATABASE or ALTER DATABASE failed because the resulting cumulative database size would exceed your licensed limit of 10240 MB per database.

     

    I am running SEP 12.1.4. Any suggestions on what I can do to fix this?



  • 2.  RE: SEPM is not getting latest virus definitions

    Posted May 15, 2014 08:30 AM

    Do you know if changes took place on any of the DB tables recently?

    How many content revisions are you keeping? Over 30?

    Seems like a similar issue here:

    https://www-secure.symantec.com/connect/forums/sepm-event-id-7203-when-checking-latest-virus-defs#comment-8626221

    TECH106075 Symantec Endpoint Protection Managers using a Microsoft SQL database no longer host the latest definitions and client install packages

    TECH104892   How to use the Validation Tool for the Symantec Endpoint Protection Manager Database.

    TECH184770   Symantec Endpoint Protection Manager (SEPM) SQL Database size (autogrowth)



  • 3.  RE: SEPM is not getting latest virus definitions

    Posted May 15, 2014 08:56 AM
    Please check below articles. Symantec Endpoint Protection Managers using a Microsoft SQL database no longer host the latest definitions and client install packages. Article:TECH106075|Created: 2008-01-30|Updated: 2014-04-11|Article URL http://www.symantec.com /docs/TECH106075


  • 4.  RE: SEPM is not getting latest virus definitions
    Best Answer

    Posted May 15, 2014 10:23 AM

    Erm, the second SQL error (1824) is the most telling in this instacnce.

    It looks like you have the SEP DB hosted on a SQL Express instance, which has a fixed Max DB size limit, and you've hit it.

    Your options are to move/upgrade the SEP DB to proper SQL Instance (running Stadard Edition of higher, on one of the supported SQL Versions), or switch to the embedded DB. (using the DR method).

    More info below:

    Best Practices guide to moving the Symantec Endpoint Protection Manager SQL Server database from an existing SQL Server database to a new SQL Server database

    Article:TECH104723  |  Created: 2008-01-15  |  Updated: 2012-04-10  |  Article URL http://www.symantec.com/docs/TECH104723
     

    Symantec Endpoint Protection Manager: Moving from the embedded database to Microsoft SQL Server

    Article:TECH102547  |  Created: 2007-01-27  |  Updated: 2012-08-16  |  Article URL http://www.symantec.com/docs/TECH102547
     

    With regards to the seonc article here, just go in the other direction wink

     



  • 5.  RE: SEPM is not getting latest virus definitions

    Posted May 15, 2014 10:27 AM

    Incidentally, if you have no choice other than to use this SQL Express instance, then I'd recommend lowering the number of definitions held by the SEPM:

    Best Practices for configuring the number of content revisions to keep in Symantec Endpoint Protection Manager

    Article:TECH92225  |  Created: 2009-01-05  |  Updated: 2013-11-05  |  Article URL http://www.symantec.com/docs/TECH92225
     

    Note that lowering this number will increase the chances a full fat definition file (of about 300MB in size) will be sent to your clients when they need an update.

    It's obviously recommended that you move to a fully supported DB type anyway.



  • 6.  RE: SEPM is not getting latest virus definitions

    Posted May 16, 2014 10:39 AM

    I'm going to install SQL standard and move the DB off express. Will report back.



  • 7.  RE: SEPM is not getting latest virus definitions

    Posted May 19, 2014 01:24 PM

    I moved the DB from SQL express to SQL standard and that fixed the issue. Thanks for your help SMLatCST