Endpoint Protection

Hello,

We're running SEPM 11.0.4414.26 on a dedicated "server" in a virtualization environment (kvm to be specific).  As a result, disk i/o is a continuing issue.  Our problem is that SEPM, or more specifically, dbserv9.exe, the embeded database, sits and chews on the disk continuously, using 70-95% of the available disk io on the underlying storage.  Nobody is doing anything and there are about 40 workstations with managed SEP on them.  Any ideas where I should start looking to find out what/why this process needs to constantly read the same file repeatedly?  I'm guessing queries are occuring, but why?  And 24/7 for days?  Or is it some sort of consistency check that we just haven't ever let finish--during high loads, we're often forced to shutdown SEPM to give disk io to other servers that need it.

Any help would greatly be appreciated.  Thank you all for your time.

-CJO-

A couple of things...  2GB of RAM or more is a good amount of memory to have for the SEPM.  Dedicated memory, not overcommitted memory.  You may not have allocated enough CPU too?  two works great in most cases, probably in yours too.

If your clients are set to push mode, change it to pull, and increase the time in which the clients check in and refresh the database.

If you have LiveUpdate set to "Continuous,"  Dont.  Set it for around 4hr-5hrs.
Also up the content revisions for LiveUpdate defs to over 20 (default is 3).  It will consume more disk space, but use less network bandwidth and disk I/O by not having to send full defs (over 100MB x 40Hosts) if they are off for the weekend.  

Lastly, You may want to look at upgrading the SEPM to the current RU6 MP1 from your current MR4 build.  The build number is 11.0.6100.x, two major revisions higher, with some hotfixes in between...  

Like the previous poster said, migrating to RU6 might be a good idea too. You are running software that's nearly 2 years old now.