Symantec Management Platform (Notification Server)

Hi everyone,

I have established Notification Server in our region (7.1 SP2) which is connected to eight Site Servers (Task + Deployment roles) in eight geographically distinct sites. A lot of these sites have very slow (sub-1Mb/s) connections back to the Notification Server, with up to 180 clients at each site. I was able to deploy the agents and Inventory plug-in without too much WAN traffic thanks to multi-cast and deployment from site servers.

I am however striking a problem with the Full Inventory collection process, currently scheduled to occur one a week at midday (it needs to happen when the computers are on naturally). I was under the impression that inventory data would be sent from the PCs to their respective site servers which can then report back to the Notification Server during off-peak hours. Unfortunately that is not happening and every PC attempts to send the full inventory data directly to the Notification Server. Even throttled to 3kb/s for each agent that would kill our WAN links.

Is there a way of configuring the agents to report their full inventory to their site servers instead? Thanks in advance.

No, but you can fix your scheduling.  First, run delta inventories so you're only recording what changed in the inventory.  There is no need to report a full inventory each week -- only once a month is fine.  Delta inventories record and upload the changes, while a full inventory uploads everything.  These make a huge difference in size.  The only benefit of a full inventory is to know you're starting with a good base, and to delete data.  For example, if a program is uninstalled, a delta will not notice this; a full inventory is required.

Second, schedule these for outside of business hours.  If you schedule it for just outside the business day--say, 7 o'clock p.m.--you will be uploading deltas to the Notification Server during a slow bandwidth time.  Any computers that are off will report inventory when they turn on, usually in the morning.

Finally, consider percentage-based throttling, which will not destroy the WAN.  Your current settings are very capable of killing it.  Even if it's 3 kilobits per second, with 180 at each sub-1000Kbps site, that's over half your potential bandwidth.

Site servers are not capable of processing inventory, so there is no benefit to reporting inventory to a site server, because the entire data must still be uploaded to the Notification Server.

and use that for patching, software rollouts and inventory. That can also emphasise that they should leave their PCs off every other night. Or use Out Of Band (OOB) solution to power the PCs on for a few hours on evening a week.

Thanks for the reply. It's a pity that I can't use the site server as a sort of inventory data aggregator, even if it can't process the data itself. As almost all of the machines are powered off at night I suspect I'll be swapping a flood of data at midday with a flood of data in the morning if I set them to report after-hours. There would at least be a little more random variation in the reporting time. Assuming I set the agents to 1% of the maximum download rate, would that mean that 100 clients agents would swamp the connection? And I'm guessing that I need at least one good full inventory from the clients before I can start using deltas? Thanks again for the assistance.

The other thing to do as well as all the suggested things is to split down your full inventory over the week and make it occur once a month. to go with this you want it to throttle the sending of those over x number of hours 4 - 6 would make alot of sense.
Basically what you would end up with is:

Week 1,3,4,5 - Delta everything whatever days you want.

Week 2
Monday - FULL - Hardware with all advanced hardware ticks and throttled over x hours
Tuesday - FULL - Software - Advanced ticks in OS and User Groups and throttled over x hours
Wednesday - FULL - File Scan and throttled over x hours.

I can't remember if this would help either but it might. that would be to change the Targetted agent settings to compress events over xKB. you could possibly try bring that size down and it may compress those events.

the other thing would be to Wake machines up in the evening and run as the guys above have advised.

Hi there,

As JimChud noted the throttling feature makes a substantial difference. I worked this out a few weeks ago, clients are now throttled over 8 hours with no reported bandwidth issues.

Glad i could help :)