What happens every X minutes in Endpoint Protection Manager
Article ID: 155235
Updated On:
Products
Issue/Introduction
What tasks does the Symantec Endpoint Protection Manager (SEPM) run, and at what default times?
Resolution
Multiple timers are created on the SEPM server to schedule server tasks. Individual timers (Java threads) execute one or more tasks. When more than one task is scheduled on a single timer, the tasks can delay each other.
Fixed-delay task:
In fixed-delay execution, each execution is scheduled relative to the actual execution time of the previous execution. If an execution is delayed for any reason (such as garbage collection or other background activity), subsequent executions will be delayed as well. In the long run, the frequency of execution will generally be slightly lower than the reciprocal of the specified period.
Fixed-rate task:
In fixed-rate execution, each execution is scheduled relative to the scheduled execution time of the initial execution. If an execution is delayed for any reason (such as garbage collection or other background activity), two or more executions will occur in rapid succession to "catch up." In the long run, the frequency of execution will be exactly the reciprocal of the specified period.
1) Critical Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
StateCheckpointTask |
1 second |
1 minute |
Updates the Server State. Also updates the default server list if IP address is changed. |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
2) Notification Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
SecurityAlertNotifyTask |
10 minutes
1 minute
|
scm.securityalertnotifytask.notification.interval
(default 10 minutes)
|
When this task is running, it checks the current server see it is a reporting server of local site. It will process the notification only if it’s a reporting server. Once the notification condition occurs, then it will trigger SEPM to run a batch or executable file or send email to admin etc. It’s up to the configuration when adding a new notification condition. |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
3) Compiler Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
PackageTask |
2 seconds |
2 seconds |
Publishes the client packages and compiles the policy profile. |
Fixed delay task |
SEP11.x SEP12.x SEP14.3.x
|
|
GupListPublishTask |
0 seconds |
scm.guplistupdatefrequency.seconds (default 60 seconds) |
Publishes the GUP List if there is any change at DB table GUP_LIST. |
Fixed delay task |
SEP11.x SEP12.x SEP14.3.x
|
|
EnforcerCompilerTask |
5 seconds |
30 seconds |
Compiles Enforcer profile if SNAC license is present. At SEP12.x, this task will compile profile for all enforcers across all sites. At SEP11.x, it only compile profile for local site. |
Fixed delay task |
SEP11.x SEP12.x SEP14.3.x
|
|
TdadPublishTask (new) |
0 second |
1 Minutes |
Publishes the TDAD data and compiles the TDAD policy |
Fixed delay task |
SEP 14.3.x |
4) Log File Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
AgentLogCollector |
10.5 seconds |
scm.timer.logcollection
(default 60 seconds)
|
Processes the client logs. |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
|
ApplicationCollector |
300 seconds |
scm.timer.appcollection
(default 3600 seconds)
|
Gets info about learned apps from clients configured to provide that info. |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
5) Agent Info Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
AgentInfoTask |
11 seconds |
scm.timer.agentstatus
(default 120 seconds)
|
Processes OpState from clients and Enforcer server. |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
6) Scheduler Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
RequestHandlerCacheRefreshTask |
5 seconds |
5 seconds |
Refreshes the internal object cache. This is used for performance improvement. |
Fixed delay task |
SEP12.x
SEP14.3.x
|
|
EmailPackagePurgeTask |
7 days |
7 days |
Deletes the email packages (under Inetput/EmailPackages folder). |
Fixed delay task |
SEP12.x SEP 14.3.x |
|
ScheduledReportingTask |
10 minutes
1 minute
|
scm.securityalertnotifytask.notification.interval
(default 10 minutes)
|
Generates the scheduled reports, and send reports to admin via Email. If the current server is not a reporting server, then this task will skip to execute. |
Fixed delay task |
SEP12.x SEP14.3.x
|
7) Telemetry Scheduler Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
TelemetryDataTask |
if (enableDelay) |
configured number of days
(default 7 days)
|
Collects the Telemetry data |
Fixed rate task |
SEP11.x
SEP12.x
SEP14.3.x
|
8) Fast Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
ClientTransportInfoTask |
10 seconds
0 seconds
|
10 seconds |
GetSyServerInfo - Query Secars for state info including throughput. This task also calculate the site health status base on the server. If the DB is down, then this task will skip to execute. If license is invalid or the DB data is crashed, then this task will shutdown the SEPM server. |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
|
AgentOnlineStatusTask |
2 seconds |
20 seconds |
Updates the agents online status by getting the data from Secars |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
|
IISCacheTask |
1 second |
scm.timer.iiscache
(default 120 seconds)
|
Updates Agent, command and enforcer cache in Secars |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
|
IdentitySynchronizeTask |
3 seconds |
5 minutes |
Updates the Identity cache by getting data from IDENTITY_MAP table |
Fixed delay task |
SEP11.x
SEP12.x SEP14.3.x
|
|
PackageUpdateTask |
10 seconds
removed from 14.3.x
|
1 minute |
Used in SBE only |
Fixed delay task |
SEP12.x |
|
SyncLuConfigTask |
30 seconds
removed from 14.3.x
|
3 seconds |
Writes the LU hosts info for Liveupdate to act up on |
Fixed delay task |
SEP11.x SEP12.x |
|
FileReplicationTask (new) |
1 second |
scm.timer.file.replication.task
(default 5 minutes)
|
Pulls the VIP pkcs, keypass files, smartCard.pem and CRL.pem from the remote server. |
Fixed rate task |
SEP14.3.x |
9) Slow Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product
|
|
ReportDataTask |
Beginning of the next hour |
1 hour |
Generates reports and inserts data into History table |
Fixed rate task |
SEP11.x
SEP12.x
SEP14.3.x
|
|
FailedEmailResendingTask |
1 hour |
24 hours |
Resends all the failed email messages |
Fixed rate task |
SEP12.x
SEP14.3.x
|
|
LicenseComplianceCheck Task |
Mid night |
scm.timer.license
(default 24*60*60 seconds)
|
Checks for license expiration and over deployment |
Fixed rate task |
SEP12.x
SEP14.3.x
|
|
LicenseManagerTask |
1 minute |
15 minutes |
Checks and restores the license states |
Fixed rate task |
SEP12.x
SEP14.3.x
|
|
AjaxSwingTempCleanupTask |
1 minute |
1 week |
Cleans up ajaxswing temp folder |
Fixed rate task |
SEP12.x
SEP14.3.x
|
|
ADSITask |
3 seconds |
scm.timer.activedirectory
(default 60*60 seconds)
|
Does active directory sync |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
|
SecurityDataTask |
1 minute
removed from 14.3.x
|
4 hours |
Processes Virus categories and ThreatCon |
Fixed delay task |
SEP11.x
SEP12.x
|
|
DatabsePropertyRefreshTask (new) |
5 seconds | scm.timer.database.property.refresh.minutes (default 5 minutes) |
Refreshes the database properties |
Fixed delay task |
SEP14.3.x
|
|
DiskFileCleanupTask (new) |
6 seconds | 24 hours |
Handles routine cleanup of files on disk that are no longer needed |
Fixed delay task |
SEP14.3.x
|
|
OverduePingTask (new) |
4 minutes |
scm.overdueping.interval.mins
(default 14 days)
|
Ensures that Project Cache ping data is sent at least once every N weeks |
Fixed delay task |
SEP14.3.x
|
|
SEPNewsUpdateTask (new) |
15 minutes | scm.sepnews.updatefrequency.minutes (default 12 hours) |
Retrieves SEP product notifications |
Fixed delay task |
SEP14.3.x
|
|
SepmComponentUpgradeTask (new) |
scm.component.upgrade.minutes (default 24 hours) |
scm.component.upgrade.minutes
(default 24 hours)
|
Installs newer revision of SEPM API content |
Fixed delay task |
SEP14.3.x
|
|
ThreatCatTask (new) |
0 second | N/A |
Gathers risk properties. Run it immediately when saving the LU content. |
Fixed delay task |
SEP14.3.x
|
10) External Log Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
ExternalLoggingTask |
10 seconds |
1 minute |
Sends logs to Syslog Server and export logs to a dump file |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
11) Backup Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
BackupSchedulerTask |
20 seconds |
1 minute |
Backup the database |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
12) Update Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
LiveUpdateTask |
5 minutes |
1 minute |
Runs the Liveupdate |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
|
PackageCleanupTask |
Max (60*60 seconds, scm.packagecleanup.delay) 0 seconds |
Max
(24*60*60 seconds, scm.packagecleanup.period)
|
Deletes the packages in SBE only |
Fixed delay task |
SEP12.x
SEP14.3.x
|
|
DeltaContentTask |
6 seconds 0 seconds |
scm.timer.lu_delta
(default 2 seconds)
|
Generates the delta between contents |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
|
DeltaPackageTask |
6 seconds |
scm.timer.lu_delta
(default 2 seconds)
|
Generates the delta between packages |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
|
RapidResponseContentTask |
5 seconds |
10 seconds |
processes jdb abd vdb files |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
|
ContentMergeTask (new) |
6 seconds
|
scm.timer.lu_delta
(default 2 seconds)
|
Merges definition content for building forward and reverse deltas |
Fixed delay task |
SEP14.3.x |
|
TempCacheCleanerTask (new) |
60 seconds |
scm.delta.tempfilesystemcache.filelifetime.minutes
(default 24 hours)
|
Removes the files in tempcache content folder |
Fixed delay task |
SEP14.3.x |
|
WhitelistLiveUpdateTask (new) |
10 seconds |
1 minute |
Updates whitelist info via LiveUpdate |
Fixed delay task |
SEP14.3.x |
13) Data Mining Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
SecurityMiningTask |
11.5 seconds 12 seconds |
scm.timer.securitymining
(default 60 seconds)
|
Inserts data into SEM_COMPLIANCE_CRITERIA table based on the Host Integrity data in AGENT_SECURITY_LOG_1(2) |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
14) DB Maintenance Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
TruncateTxnLogTask |
10 minutes |
10 minutes |
Truncates the transaction logs |
Fixed delay task |
SEP12.x
SEP14.3.x
|
|
RebuildIndexesTask |
10 minutes |
10 minutes |
Rebuilds the indexes |
Fixed delay task |
SEP12.x
SEP14.3.x
|
15) Temp Log Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
AgentTrafficLogCollector |
12.5 seconds |
scm.timer.logcollection
(default 60 seconds)
|
Processes log data from inbox/log/traffic |
Fixed delay task |
SEP12.x
SEP14.3.x
|
|
AgentSecurityLogCollector |
13.5 seconds |
scm.timer.logcollection
(default 60 seconds)
|
Processes log data from inbox/log/security |
Fixed delay task |
SEP12.x
SEP14.3.x
|
16) AV Log Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
AgentAVLogCollector |
11.5 seconds |
scm.timer.logcollection (default 60 seconds)
scm.timer.logcollection.faster (default 2 seconds)
|
Processes log data from inbox/log/tex |
Fixed delay task |
SEP12.x
SEP14.3.x
|
17) GC Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
GarbageCollectorTask |
5 minutes |
5 minutes |
Cleans up internal object cache and runs the JVM garbage collector |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
18) Agent Sweeping Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
AgentSweepingTask |
scm.timer.objectsweep or midnight
scm.timer.objectsweep.delay or midnight
|
scm.timer.objectsweep
(default 24*60*60 seconds)
|
Purges the expired/stale data |
Fixed rate task |
SEP11.x
SEP12.x
SEP14.3.x
|
19) Status Timer:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
AgentLastCheckInTask |
120 seconds |
scm.timer.lastcheckin
(default is 120 seconds)
|
Updates the client's last update time in sem_agent table based on the data from Secars |
Fixed delay task |
SEP11.x
SEP12.x
SEP14.3.x
|
20) Replication:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
ReplicationTask |
Console UI configuration. (default is 120 minute for SEP12.x, default is 5 minutes for SEP 11.x) Console UI configuration. (default 24 hours) |
Console UI configuration.
(default is 120 minute for SEP12.x, default is 5 minutes for SEP 11.x)
Console UI configuration.
(default 24 hours)
|
Run replication between local site and remote partner. It will be scheduled via Console operation at replication environment. |
Fixed delay task |
SEP11.x
SEP12.x SEP14.3.x
|
|
ReplicationCancelTask |
0 |
N/A |
Cancel the replication task between local site and remote partner. Run it immediately. |
Fixed delay task |
SEP11.x
SEP12.x SEP14.3.x
|
21) Secars Task:
|
Task |
Initial Delay |
Frequency |
Description |
Type |
Product |
|
PushEventMonitor |
0 |
0.5 second at SEP11.x
2 seconds at SEP12.x,
SEP14.3.x deleted
|
This task works under push mode. Travel every group push status, if the close flag is true, then push all agent connections to queue for termination. Check the command table, if this table has commend, then find corresponding agent state, push its connection to queue for termination. |
Fixed rate task |
SEP11.x SEP12.x |
|
ConnExpiredMonitor |
0 |
30 seconds
SEP14.3.x deleted
|
This task works under push mode. Check every agent state in table, if the CurrentTime - LastConnectTime > HeartbeatTime, then push the expired connection to queue for termination. |
Fixed rate task |
SEP11.x SEP12.x |
22) Binary Results Task:
| Task | Initial Delay | Frequency | Description | Type | Product |
| CommandBinaryResultsTask (new) | 1 minute |
scm.timer.agentstatus
(default 120 seconds)
|
Stores the command binary results into the command table | Fixed delay task | SEP14.3.x |
23) Content Events Timer Task:
| Task | Initial Delay | Frequency | Description | Type | Product |
| ContentEventsProcessingTask (new) | 0 second | 60 seconds | Processes the full content download events captured by secars and uploads them into the database | Fixed delay task | SEP14.3.x |
24) Group LAN Sensor Info Timer Task:
| Task | Initial Delay | Frequency | Description | Type | Product |
| GroupLanSensorInfoTask (new) | 1 second | scm.timer.group.lan.sensor.minutes (default 10 minutes) |
Maintains the list of groups that have Unmanaged Client Detectors
(LAN sensor clients)
|
Fixed delay task |
SEP14.3.x
|
25) Smart Card Cert Validation Timer Task:
| Task | Initial Delay | Frequency | Description | Type | Product |
| SmartCardCertValidationTask (new) | 30 seconds |
smartcard.cert.validation.interval.minutes
(default 120 minutes)
|
Validates all root and intermediate certificates in the background | Fixed delay task | SEP14.3.x |
26)Stat Ping Timer Task:
| Task | Initial Delay | Frequency | Description | Type | Product |
| StatPingTask (new) |
Random minutes
(between 60 and 120)
|
scm.statping.interval
(default 15 minutes)
|
Runs the stat ping to send the telemetry data | Fixed delay task | SEP14.3.x |
Feedback
