Endpoint Protection

Been running RU6 on our SEPM for a couple of weeks.  At first, I didnt mind the email message until I had some time to investigate.  I just queried some of the clients on the list only to find out they all had the latest definitions.  So why the alerts?  Honestly, if I cant make out the problem from the notification itself, what good is it?   There is no help for each of the the Reason codes on the report and I cant find ANYTHING about these codes in the Symantec Endpoint Protection Installation and Administration Guide for 12.1.6  . Also a alot of these so called full def downloads are only 1 MB in size.  Am I missing something?

With the way the new content is built, 1MB is considered a "full" size. I gave up dealing with these alerts because they're too cryptic and not much info out there. Plus, 1MB is a blip on my network.

Hi Brian , can you please share some more details on your statement . What I mean is have they changed they way the content was used to be built , like I remember in 12.1.5 or earlier version the full.zip for AV signatures were used to be 300-400 Mb atleast from the SEPM to clients . So what you mean in 12.1.6 they have reduced this size of Full.zip to 1MB ? would really appreciate your response

The problem is that ALL types of content are triggering full def notifications. But only AV/AS content (up to 600 MB) is really big. It's not possible to adjust the notification conditions only for alerts of AV/AS full content. That should be changed. You can support my idea for this:

https://www-secure.symantec.com/connect/ideas/full-content-notifications-special-content-types

Greg12- I voted to support your idea. Thanks!  I am still waiting for someone from Symantec to chime in why the codes are not documentented and how we are supposed to troubleshoot clients on the report.

we have a change that filters only on AV defs in a release eta end of 2015

Hi Josh,

Will this fix be included in some new MP (for example 12.1 RU6 MP3) or in new release? And when this is expected to happen because end of this year is...2 more months?

Thanks

I too am getting these as of a couple weeks ago, even when I changed it to a daily update with a +/- 2 hour randomization factor (more than enough to distribute our clients). The reason code we are getting is 6: "Tomcat hinted to skip deta generation."

I'm wondering if you are getting the same?

Thanks.