Endpoint Protection

Hello all,

I got curious about this situation.

Consider a GUP is assigned to 1 branch and in this branch there are multiple SEP clients.

Say 2-3 clients having insufficient space at C:/ will it constantly request for full definition instead of deltas from the GUP? Thus from this GUP will it constantly connect to SEPM to do the same?

I need confirmation on the latter...

https://www-secure.symantec.com/connect/ideas/fix-repeated-signature-download-sep-client-low-disk-space

Hi,

SEP clients communicate with the SEPM to receive policy updates & those are in few KB's.

If you have configured to bypass the GUP in that case only clients will take updates from SEPM.

Check following article:

SEP clients download the same content repeatedly from the SEPM or GUP when they have low disk space

http://www.symantec.com/docs/TECH93110

Hi Chetan,

No.It's not configured to bypass GUP.

Let me rephrase.

Will having clients with low space making GUP to request/download full defs constantly from SEPM?

Hi,

If GUP has low disk space then traffic will be in between GUP and the SEPM

If clients have low disk space and GUP is ok than traffic will be in between client and the GUP.

Hello,

Will having clients with low space making GUP to request/download full defs constantly from SEPM?

GUP would download full defs when the client is out of date for a number days. However the traffic increases with each heartbeat interval when the GUP client fails to update itself. 

Check these Articles:

When will a client download a full definition set from a Symantec Endpoint Protection Manager or Group Update Provider? http://www.symantec.com/docs/TECH131528

Symantec Endpoint Protection clients download full definitions from Group Update Provider or from Symantec Endpoint Protection Manager http://www.symantec.com/docs/TECH122612

With default LiveUpdate content revision settings configured within the Symantec Endpoint Protection Manager, clients are downloading full definition updates instead of delta updates http://www.symantec.com/docs/TECH94916

There is a tool which you could use for GUP health-checking:

SEP Content Distribution Monitor

https://www-secure.symantec.com/connect/downloads/new-sep-content-distribution-monitor-gup-health-checking

VIDEO: https://www-secure.symantec.com/connect/videos/sep-content-distribution-monitor-introduction

Hope that helps!!

The GUP space is ok.

hmmm so client will not make GUP as a "proxy" to get full definition from SEPM?

We had this situation once.

The clients were more than 15 days old with their updates and eventually required a complete definition pack since the GUP / SEPM will not store definitions for more than 15 days (number of  revisions) by default.

It contacts the GUP for a full definition and the GUP downloads the same. Since the client cannot download the same due to space constraints, it will kepp on requesting full defs from the GUP.

The client communicates with the SEPM for definition information and the information will be a full definition with the latest delta. The client then goes to the GUP, the GUP will have to download the full set everytime there is a new delta.

So, the communication will be increased between the SEPM and the GUP and the client and the GUP.

Hope that is clear.

I think NRaj perfectly answer my question. We had the same situtation too!!

So anything older than XX days (number of revs) will force GUP to download full definition instead of deltas.

In this situtation if a client keep having insufficient disk space at C:/ it will force GUP to download full defs right?

The thing is if on next day client still having insufficient space, it will still force GUP to download full defs...

Yes you are right. That is what was seen to be happening.

I hope this get fixed...or SEP being modified so that once it found a client with insufficient space it will send alert and stop nagging latest definition...

Too troublesome for the bandwidth...

I have voted for an existing Idea in the forum... seems no one looking