Endpoint Protection

Hello,
I would like to know how far SEP can go for filling up c: partition.
Is there a mechanism in place that prevents collecting updates, definitions and etc and can clean up unnecessary stuff after installation.

What should be, could be done manualy or with little script to clean up C: from all above and forget about a chance that server will crush.

In my situation I run Sep on virtual  2003 with only one partition 10 GB of size. I need to keep SEP as clean as possible.

Thanks,
Michael.

Do you have SEP or SEP Manager on this VM

if it is SEPM then you can control the size content size.
SEPM --ADMIN- Servers- Local Site (Site name) -Properties--Liveupdate --on the bottom change the content revision to 3.
You can also unzip stop client packages unzipped.
When you are plannin for upgrade then you cn check it back.
 

Hi,

What is the version you have?
Could you specify what are the biggest folders or files?
10 GB are a bit small for SEPM.

Regards,

To Kumar:

1. I am talking about SEP Manager on dedicated 2003 VM.

2. I checked what you suggested.
Content revision is 3 by default. I believe if I will reduce it to 2 or 1 nothing critical will happen.
Please advise...

3. I unchecked keep unzipped ... box.

BTW, it is small office with up to 10 computers. So it is not critical heavy load network. All I need up to date reliable protection.


To Giuseppe:

1. Ver.  11.04202.75

2. I double checked it is 14 GB VM (c: only)
But I want to reduce it to 10GB. For smaller backup. Currently c: is 7GB
Hope that Kumar's advices will keep it not growing.

Pls. let me know if it still may grow because of SEP behaviour.


AND one more related question. How to keep target pcs SEP clean and compact?
I don't care about workstation. But I want to prevent SEP from growing on few optimised VM 2003 servers.

Thanks,
Michael.

 Well for 10 computers you can bring it down to 2 but i definitely won't suggest 1.
Everything gets cleanedup automatically ..so even if you delete it now agagin it will fill in next 4 hours.
What are the compoents you have installed on your clients ? is it all the components or just Antivirus and Antispyware ..if it is just Antivirus and Antispyware you can save some more space by not downloading definitions for them.

For emergency you can delete the contents of this folder but it will fill in next 4 hours
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads

Regarding my second question, I asked about folders and files not the whole C.
Please post an answer like:
"the folder XXX is YY GB, full of .tmp files... the DB is... etc...".
If we know what is taking space, we can know what you have to tune...

Regards,

@Guiseppe.Axia: I don't think he actually has a problem as of yet. There is not an actual problem yet, he just wants to know what he can do to keep something like this from happening since he has the SEPM installed on such a small VM.

@mla: I do not think you should set the content revision number to any lower than three. Here is why. Liveupdate will run every 4 hours. If you have three content revisions this gives you 12 hours of coverage total. So if your computer is off for more than 12 hours without getting updates you will be forced to download the full 55 mb defintion instead of just the small delta files. If you set this to 8 hours or 4 hours then you will be forced to download the full updates much more often which leads to an increased network load. But on the other hand you will only be saving ~55mb for each revision number you set it two. So if you set it to two instead of three you only save 55mb. To me this is not worth it, but it is your system, but that is the trade off just to let you know.

Another issue i see with having such a small parition to run this on is corrupt virus definitions. It does not happen all the time but it can. What happens is the definitions header gets corrupted, and in this header the information about the definitions size is stored. Since it is corrupted your computer reads it as 0kb or no update so it sets out to download it again and again and again until you are out of space. For only 10gb or so this won't take long. Again this doesn't happen all of the time but a quick forum search you will find others who have had this problem. One idea I had (not supported by Symantec) is to set a cap on the update folder. If you were to set this cap to lets say 200 mb this assures that only 3 definitions can be stored. Again this is not supported and not tested. So if you going to try this do so in a test environment before you actually deploy it. I am also not sure how to go about this, but I know it is possible to set a cap on network folders, so I am sure you can do it for local folders in Windows as well. Google will probably give you a artical on it.

Cheers,
Grant

Also just to let you know I have been running a SEPM in only 8 gb vmware for about a month now and havn't had issues. Only 4 clients in this environment though (for testing purposes)

Regarding the number of revisions, every revision takes about 100 MB for the 32 bit version and 100 MB for tthe 64 bit. If you reduce it to 2, you will save about 200 MB.
The value "1" will cause the inability to publish the definitions, it should be forbidden by the GUI...

Regards,