Endpoint Protection

Hi all,

I'm using v12.1.5 and all of sudden it has started to eat up the drive C (50GB), leaving me with just under 200MB of free space.

I have investigated and have found that C:\Users\semsrv\AppData\Local\Temp has 910 folders, from SymDelta_68 all the way to SymDelta_6140 which weights at about 30GB. Yikes!

The 'Number of content revisions to keep' is currently set to 5, so I am not sure what is happening. We have 3,000 endpoints and yes I am aware that we need to keep around 90 as per to http://www.symantec.com/business/support/index?page=content&id=TECH96214 but this is not currently possible due to lack of disk space.

SymHelp was run but it came back as 'no issue'. What is causing this issue and how do I resolve this?

Thanks all.

Tony,

Probably best to get support on a call for this. I haven't seen this issue myself.

Thanks. Yes, I'm starting to think that I need to do that as I haven't had any luck with searching here and on the Internet. :/

Now have 20MB of free space!

Hopefully support will know what's up with it...

Yes we can delete the contents of Temp folder present under "C:\Users\<Service_Account_Name>\AppData\local\ ". Make sure that you are deleting the contents of the temp folder and not the temp folder itself.

Warning: While it is safe to delete these files, it is best not to do this while installing or uninstalling anything.

• Click on Start and then Run. 
• In the text box in the Run window, type %Temp% and click OK. A folder full of files and other folders will appear. 
• All of the folders and files you see in this Temp folder are no longer being used by OS and can safely be deleted. 
• To remove individual folders or files, hold down your Ctrl key while left-clicking on each item you want delete. Release the Ctrl key when you're finished. 
• To delete these items, hit your Delete key or choose File and then Delete from the menu. 
• Confirm that you want to delete the files by clicking Yes on the Confirm Multiple File Delete window that opens. 
• If you'd instead like to remove everything inside the Temp folder, choose Edit and then Select All from the menu. 
• Note: If you're prompted that there are hidden files in this folder, just click on OK to bypass the message. 
• Now that all of the files and folders are selected, hit your Delete key or choose File and then Delete from the menu. 
• Confirm that you want to delete the files by clicking Yes on the Confirm Multiple File Delete window that opens. 
• After all of the files have been deleted you can close the window and empty your Recycle Bin, permanently removing the files from your machine.

Hi,

In our environment also we are facing same issue if we delete it after sometime it fills up the disk space.

Please let us know the root cause of this issue, it occurs only after upgrading to SEPM 12.1 RU5.

Thanks,

Kannan R.

Hi Chetan,

Thanks for the reply, yes that's what support has advised me as well. But overnight, they have returned, now at 7GB of data in the Temp folder.

Something is not doing the 'clean up' job properly after files extractions.

I have double checked the permission of the temp folder and 'semsrv' has FULL permission, so they should be able to delete these files, correct?

The weekend is approaching and I really don't want the drive C to be full over the weekend where I will not be working.

Please advise - thanks.

Tony

I think this is a bug with SEP 12.1 RU5 client.

If this is the only affected client then I would suggest to roll back the client to previous version of SEP.

System may required minimum two reboots to complete this task. Plan it accordingly. 

Actually, this is on SEPM server, and not a client issue.

That's why it's criticial that I get this resolved before the weekend.

I can think of batch file which can run automatically to clean up the content.

Thanks, but that's an 'temporary workaround' - the issue will still exists.

I need a long term fix. It was working fine until recently. I've made no changes to the settings and no one knows why. :(

Could you share the support case number.Thanks!

I have sent you an PM.

Thanks.

I have been told that this is a Known Issue with v12.1.5 and v12.1.6 should resolve it, hopefully.

So, for now, we will have to manually delete these files (or using scheduled batch file)

Tony

Is there a particular setup that causes this? I don't see this issue in my environment.

Support hasn't said why it's happening and they're still investigating but they're aware about it. I'm waiting for them to get back to me toa sk further details about my setup.

It's affecting my 3 x SEPM servers. All of them are replicated so might be related...?

replication is something I'm not doing so maybe this is why...

Can you check how many client online, offline, disable, update, etc...sometime SEPM generate to much log file in this area. 

I think reduce log file is a solution here.

Nothing to do with that, it's the DAT files. (see previous comments)

But thanks for the reply.

Hi,

I have exactly the same problem on my manager...

Version 12.1.5 build 5337

version FR

Server : W2008 Standart 32b

Please raise a case with support, so they will be aware about other people having this issue.

Thanks,

SEPM 12.1.6 are now released.

See Chetan Blogs

https://www-secure.symantec.com/connect/blogs/sep-121-ru6-12161686000-now-available-download-flexnet

New fixes in Symantec Endpoint Protection 12.1.6

https://support.symantec.com/en_US/article.TECH230558.html

Symantec™ Endpoint Protection 12.1.6 Installation and Administration Guide

https://support.symantec.com/en_US/article.DOC8645.html

I did see it, thanks. I was part of the v12.1.6 beta test. Sadly this new fixes does not applies to my issue - they have found soemthing different on our setup, so waiting for someone to investigate this further.

Just to add some more info.  I've updated my environment to 12.1.6.  We have 2008 and 2003 servers.  The '8s do not have this issue, but the '3s have it.  Their storage is at: C:\Documents and Settings\NetworkService\Local Settings\Temp. 

I'm going to assume that it's because I have the install on an out of date OS.  So it looks like batch script until I can upgrade the server. 

Is that the general consensus? 

I tracked down the issue to corrupted policies. I had to re-create them and delete the old ones - and now the issue was resolved.

Easiest way to find out is to open up all policies you have, change one setting and try to save it. If you find you're unable to save it, then it's corrupted.