Endpoint Protection

My SEPM Server is Windows 2008 R2 with 8GB RAM. SEPM version 12.1.1000.157 RU1. We have approx. 470 total Endpoints.

The server is virtual and has 100GB of disk space with 19GB free. Should the SEPM server be using 81GB of disk space, is this "normal"?

We are currently keeping 20 content revisions, is this "best practices".

Thank you for your help and suggestions.

Hi,

81GB disk spaced used by 470 clients is quite high but it depends upon SEPM configuration.

Check following articles.

Symantec Endpoint Protection virus definition folder consumes a large amount of disk space

http://www.symantec.com/business/support/index?page=content&id=TECH102927

Best Practices for configuring the number of content revisions to keep in Symantec Endpoint Protection Manager:

http://www.symantec.com/business/support/index?page=content&id=TECH92225

Maintaining the database

http://www.symantec.com/docs/HOWTO55337

Disk Space Management procedures for the Symantec Endpoint Protection Manager

http://www.symantec.com/docs/TECH96214

:

Follow this

Disk Space Management procedures for the Symantec Endpoint Protection Manager

http://www.symantec.com/business/support/index?page=content&id=TECH96214

You can do the following:

1. change the number of revisions retained by the Symantec Endpoint Protection Manager

2. edit the database retention settings for the Symantec Endpoint Protection Manager to help save disk space:

Edit More

Try the following links this should fix you're issue ....

Symantec Endpoint Security Manager: How is Database Maintenance scheduled? 

http://www.symantec.com/business/support/index?page=content&id=TECH95880&locale=en_US

Changing the log settings to reduce the size of the database

http://www.symantec.com/business/support/index?page=content&id=TECH105238&locale=en_US

 


How to quickly purge the SEPM log tables on a SQL server

It is high but it depends on your set up. What components your using, system lock down, network monitoring, are you sending all possible logs...?

Are you doing any of these?

Hello,

Could you specifically check which Symantec folder is taking the highest disk space?

What version of SEP 12.1 are you running?

I hope you are running SEP 12.1 RU1 MP1 version on your machine. If not make sure you migrate the SEPM and SEP client to the Latest Definitions.

Symantec Endpoint Protection Manager server has low disk space and the embedded database log file size is large.

http://www.symantec.com/docs/TECH166658

High Disk Space is being consumed by C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\Importpackage

http://community.spiceworks.com/how_to/show/2656

Symantec Endpoint Protection Manager 12.1 database using a high amount of Hard drive space

https://www-secure.symantec.com/connect/articles/symantec-endpoint-protection-manager-121-database-using-high-amount-hard-drive-space

Symantec Endpoint Protection Manager (SEPM) Database Transaction Log (sem5.log) Consumes Hard Drive Space in SEP SBE 12.1 RU1

http://www.symantec.com/docs/TECH178718

Hope that helps!!

I have not yet installed the MP1 release, will I run into any issues by just downloading and installing it on the SEPM server?

I decreased the number of content revisions from 20 down to 10. That cut the C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\content folder size in half. I am now at 35 GB free of 100 GB. The Symantec Endpoint Protection Manager folder is now at 27 GB total size on disk, is that about average?

In C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\ there is a folder named "db" that contains 2 files: sem5.db and sem5.log, each file is approx. 5.6 GB each with a modified date of 1/30/12 (when the server was installed). I am not sure what this is or if I can get rid of it? The database for SEPM is hosted on a seperate SQL server.

I do not have the Importpackage folder here C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\outbox\

How do I check how the logs are configured?

Could there be anything else eating up disk space?

Thank you

Both file sem5.db and sem5.log your SEPM database releated..

Changing the log settings to reduce the size of the database

http://www.symantec.com/business/support/index?page=content&id=TECH105238&locale=en_US

Hi,

Changing the log settings to reduce the size of the database.

http://www.symantec.com/docs/TECH105238

sem5.log file has grown up too high & to reduce the log file size follow this article:

http://www.symantec.com/docs/TECH169664

If you are planning to upgrade then make sure you have gone through the following comments.

The SEP 12.1 SEPM upgrade installer requires three times the current database size (sem5.db) if upgrading from pre-12.1 SEPM with the embedded database only.

SEP 11.x to SEP 12.1 Upgrade process graphical overview

https://www-secure.symantec.com/connect/articles/sep-11x-sep-121-upgrade-process-graphical-overview

In SEPM I go into Admin --> Local Site --> Edit Site Properties and I do not have a Log Settings or Database Tab???

Where do I modify the Log Settings in 12.1?

Hi,

Could you please confirm it's a Small Business Edition or Enterprise Edition?

It is Enterprise Edition. Where do I modify the Log Settings in 12.1 Enterprise?

Is 27 GB for the SEPM folder about normal or is that high? C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager

Hi,

Please check Admin--> Server --> localhost --> Edit database properties --> log settings.

27 GB is quite ok but check if any specific folder is consuming high space. As stated earlier sem5.log file should not be 5.6 GB in size, it's should not be in GB.

I have not yet installed the MP1 release, will I run into any issues by just downloading and installing it on the SEPM server?

No, even "only" 19 GB should be enough.

I decreased the number of content revisions from 20 down to 10. That cut the C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\content folder size in half. I am now at 35 GB free of 100 GB. The Symantec Endpoint Protection Manager folder is now at 27 GB total size on disk, is that about average?

The sem5.* files stem from the embedded database. They are unnecessary if you are really using an SQL Server database. So you can delete 11 GB (2 * 5.6), and we are at 16 GB, with about 11-12 GB Inetpub\content (if my calculation is right) and 5 GB for the rest. That sounds completely normal.

Could there be anything else eating up disk space?

There are many free file size visualization programs (TreeSize, WinDirStat, SpaceSniffer etc.) on the Internet. You could download one of them and analyze which folders are still wasting space.

Please see the see screen shot. This shows the Log Settings for the Database. Since it is a SQL Server Database stored on a different server, are the logs also stored on the SQL Server?

If so, I assume I can delete the 2 sem5.* files on the SEPM server since we are not using the embedded Database, is that correct.

sorry, here is the full screen shot.

Please see the see screen shot. This shows the Log Settings for the Database. Since it is a SQL Server Database stored on a different server, are the logs also stored on the SQL Server?

Yes, all the logs you are showing here refer to database tables. The entries and days settings are thresholds to prevent limitless database growing. E.g., each traffic log database table (there are two of them)  may have 50,000 entries.

There is no logging in the file system by default.

If so, I assume I can delete the 2 sem5.* files on the SEPM server since we are not using the embedded Database, is that correct.

To be on the safe side, make backups of the files.

BTW, if the files are still in use, you are not able to delete them. If you can delete them, SEPM doesn't need them