Endpoint Protection Small Business Edition

I was troubleshooting shrinking free space on my SEP server and after running WinDirStat noticed that at:

C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Data\Install\Logs

there are 19GB of DMP files.  These correspond with a full system scan that runs on Sunday mornings.  The DMP file dates are the same as when the scan finishes each Sunday.  I am getting no indication of any issues in notifications or the Protection Manager Console.  It just indicates that the scan completed with no detections.

These only started appearing on January 25, and each Sunday thereafter (the full scan runs only on Sunday mornings).  Prior to Jan 25, no DMP files...

How do I stop these logs from filling my drive space?

Can I manually delete these DMP files?

Thanks!

Tim

Yes you can delete, best to stop the service first.

May need to enagage support to find out exactly what's going on.

Hi,

Thank you for posting in Symantec community.

I would be glad to answer your query.

Try the following workaround for single client.

1) Disable Tamper Protection.
2) Open a Command Prompt window.
3) del "C:\ProgramData\Symantec\Symantec Endpoint 
Protection\12.1.5337.5000.105\Data\Install\Logs\*.dmp"
4) Using regedit.exe, set 
HKEY_LOCAL_MACHINE\SOFTWARE(\Wow6432Node)\Symantec\Symantec Endpoint 
Protection\CurrentVersion\Common Client\Debug\CrashHandler\DumpOn* to 0.
5) Re-enable Tamper Protection.
6) Open a Command Prompt window.
7) cd "C:\Program Files (x86)\Symantec\Symantec Endpoint 
Protection\12.1.5337.5000.105\Bin"
8) smc -stop
9) smc -start

Similar issue has been resolved here: https://www-secure.symantec.com/connect/forums/ccsvchst-dmp-files-filling-our-server#comment-10884921

Is there any update?

OR

If issue has been resolved could you mark this thread as a solved with the best answer that helps you :)

Chetan,

Prior to getting your response, I uninstalled the client, manually deleted the .dmp files, then reinstalled the client.  I had to wait a week to see if the solution worked permanently, as the scan that triggers the .dmp files is on Sundays.  Confirmed this morning that the .dmp files returned, so I went ahead and performed your solution.  The addition of desabling the DumpOn* registry entries sounds like the actual solution/workaround.  Thanks for your help.  I will have to wait til next Sunday to verify the .dmp files are not recreating, but based on disabling the lines in registry, I assume it will work.  ;)

Yes, it should work. We have tested it successfully.

Chetan, I just noticed an interesting side effect of your solution:

I also had the issue described in this thread:

http://www.symantec.com/connect/forums/query-failed-accessing-security-status-after-1215-upgrade

After running through the 9 steps in your previous post, I noticed the "Query Failed" message is fixed.  Console Home Screen again has a green check and "Security Status - Good".  So you may wish to relay this to the users in the "Query Failed" link a few lines up.

Thank you,

Tim

If issue has been resolved could you mark this thread as a solved with the best answer that helps you :)