Endpoint Protection Small Business Edition

Hello everyone. i'm currently trying to diagnose and fix disk space issues on our domain server. We have SEPM Small Business edition, and the program reports its version number as: 12.1.3001.165 

The endpoint protection manager is currently using just over 15 GB of disk space, which seems like an excessive amount for a security program. I am not sure what it SHOULD be using, i'd appreciate some feedback on that. We have 8 licenses, and that many computers on our network (we're pretty small)

Through various research, i have found many repeated instances of people linking to this page: http://www.symantec.com/business/support/index?page=content&id=TECH96214

and giving advice to reduce the number of stored content revisions. I am unable to do this, and the instructions on that page do not work. I'm told to change settings which simply don't exist, and so i am unable to carry out those instructions.

The instructions state the following: 

1. Click on Admin > Servers > Local Site and under Tasks, click Edit Site Properties.
2. Click the LiveUpdate tab.
3. Under Disk Space Management for Downloads, adjust the number of content revisions to keep.
4. Click OK.

Here is a picture from my administration console: http://puu.sh/6wh5F.png

I have a Admin > System instead of Admin > Servers, unless this is a mistake in the knowledgebase, it seems like these instructions were written for something different.

I can guess local site refers to the name of our server , but we have Edit Server Properties instead of Edit Site Properties

Here is a screenshot of that menu: http://puu.sh/6whcl.png

As you can see, the LiveUpdate tab only has one setting, it does not have any Disk Space Management options.

So how can i proceed from here? Please advise

check if this helps

Symantec Endpoint Protection Manager (SEPM) database transaction log (sem5.log) consumes excessive hard drive space in SEP SBE 12.1 RU1

http://www.symantec.com/docs/TECH178718

also check Simpson Holmers suggestion from this link

https://www-secure.symantec.com/connect/forums/limit-virusdef-disk-space-sep-small-business-edition

See this articles

Symantec Endpoint Protection Manager (SEPM) database transaction log (sem5.log) consumes excessive hard drive space in SEP SBE 12.1 RU1

http://www.symantec.com/docs/TECH178718

For 8 machines I dont think you SEPM would fit the bill. 

Better to have SEPM uninstalled and have all the 8 machines as unmanged installation. This would reduce the load on the server and administrative effor

Unisntall SEPM and install as unmanged

Here is the link

http://www.symantec.com/business/support/index?page=content&id=HOWTO80814

P.S: its my personal opinion  only :) 

So 15GB seems a little high for a SBE SEPM, but I am not saying it is not possible. The SEPM's primary roles is a logging/reporting service and a content/policy distribution server...There are a few things that will keep HDD space taken due to the SEPM

However, many options to configure the SEPM are limited in the Small Business Edition (SBE) - including the options to configure content revision numbers to keep, database backups, Group Communications mode, Client Control Modes, Levels of control for policies

1) The SEPM will always download full virus definition sets (these run around 600MB just for the V-defs themselves [the other protection tech is a lot smaller], If I recall it is around 310 MB for 64bit and 290 for 32bit)

2) When the defs are downloaded by the LiveUpdate Engine (LUE), they are decompressed and a copy is sent to the SEPM inboxes for processing (now you have 2 copies stored on your HDD), while that is processing, a copy is loaded onto the database (here is 3 copies) - once it has been successfully written to the database, the 2nd copy (inbox) copy should clear itself up (not always the case - I will give a path at the end to look) - if LUE completes download and the SEPM has received the copies onto the database, the first copy should clear itself (or remain in cache if the LU Settings are told to keep a cache) --- but the database is not the endgame

3) Now that the SEPM 'owns' this data, that content must be published and distributed, (Inetpub/content folders), on a SBE server - 2 additional copies are saved here, one is zipped (for clients that request the full content package, because they do not have an update sequence that the SEPM has stored - therefore cannot receive a patch and must receive the full set -- zipped files have better transfer rates over network), and then one set is unzipped so that if a client is eligible to receive a patch, the contents can be read quickly and a .dax file will be created to mark what has changed since the last content update

In the end for one content revision stored on the SEPM, 3 copies of a V-def is stored at one time -- a SEPM stores 3 content revisions total (so that is 9 sets stored), not to mention logs, install packages (which are stored at 3 times as well in a similar manner), etc...

So a SEPM install just right out the door and no client reporting and has it's three content revisions will take about

5.4GB for V-Defs (realistically, when you add in the other tech defs, it's about 6 or so GB), ~2.6 GB for install packages - add in another GB for operations and the SEPM install itself, and likely your DB is running a weekly backup so add in 3-4 GB for that

So that is around 13GB already for a fully functional and operational SEPM running within what the design is

Now that said, there are some areas to look at to see if the SEPM is in fact running properly -

The database transaction log can sometimes be an issue - the fact that is large does not mean that it is, it is something to look at

<SEPM INSTALL DIR>\DB\SEM5.LOG - look at this file - this file should trim down every four hours to 5xxKB, however, it is not uncommon to see this file grow to a large size (500MB-1.5GB) don't start playing with this file unless this file does not clear itself out every four hours (that link here http://www.symantec.com/docs/TECH178718 is what I am talking about)

<SEPM INSTALL DIR>\DATA\INBOX\AGENTINFO - this folder is an inbox for the SEPM for content processing and is used to build the patches for distribution - however, I do find it that there are files left behind in there -- stop the following services: Symantec Endpoint Protection Manager and Symantec Endpoint Protection Manager Webserver -- then you may clear out all the content in there and then start the services back up safely

<SEPM INSTALL DIR>\DATA\BACKUP - the contents in here contain the database backup - however the SBE version does not allow you to change the DB backup settings - it is on once weekly (Sunday or Monday around 12A, believe), however if you want to script it to delete it - then you should be fine. To stand up 8 machines on a new SEPM takes maybe less time then going through a database restore in my opinion...if there were a bit more machines, then I would lean the other way but ever since 12.1 RU2 with the reset comm options in the client deployment wizard - and holding onto the recovery files (in the \Server Private Key Backup\ folder) holding onto those pesky database backups are almost a thing of the past...

Anyhoo, generally I tell my customers that an operational 12.1 SEPM is running around minimally 15-20 GB but should have 30 GB free prior to install at a minimum for SBE and less than 30 clients...

Matter of fact...I just checked my SEPM on my virtual environment - there is only one client reporting to it (itself), the install size is 15.2 GB in the SEPM directory... and it is running 12.1 RU4 - so it looks like you are well within what it should be for sizewize

So should you go with unmanaged clients - it's up to you, my rule is around 5 or less clients, depends on how much trust do you have with your end-users and how much monitoring do you need...

I hope that helps

Do you need more help here ?If not please update the thread.