Endpoint Protection

Hello there all, have a strange problem with my SEP v11 system which started a couple days ago and my googling skills have been unable to divine me a solution. 

The start of the issue was when my health monitor tool on our SEP Manager server alarmed that the C drive was close to running out of disk space.  I found that the folder c:\Program Files\Common Files\Symantec Shared\SymcData\sesmvirdef64 had 20GB worth of .tmp folders in it, which I'm presuming is not how it's supposed to be.

After some googling for hints I shut down the SEP services, pulled all the .tmp folders out and stashed them in some temporary space, and also edited the HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\Content\... "CacheEntriesEx" keys to "2" from the default "3" and rebooted. 

All seemed fine until 30 minutes ago when the health monitor alarm brought my attention back and the bloody folder is back up to 17GB in size in 24 hours.

Any help on what's giong on this this cancer of a Virus Def folder?

Details on the environment:
Windows Server 2003 R2 Standard, running as a Domain Controller (not primary)
Running in VMWare ESX 3.5u2, 2 virtual CPUs and 4GB of RAM for the VM.
The server also is running BackupExec v11, and has SEP in additon to SEPM (SEPM is managing around 100'ish installs of SEP).
Other services this server serves are DNS/WINS/DHCP and RAS VPN.

-Carl Merritt
IT/Telecom Manager
www.CaliSolar.com

whats the version of symantec endpoint you are running?
please upgrade to mU5.
delete all the .tmp files inside symsdata folder if  you are running older version
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121216360648

SEPM is 11.0.3001.2224

please upgrade to the latest version , it will fix the disk space issue. wil fix your issue

Migrating to Symantec Endpoint Protection 11.0 RU5
http://service1.symantec.com/support/ent-security.nsf/docid/2009090313483348

RU5 of SEPM installed, will post tomorrow if the issue is fixed or not, thanks for your help.

Hi,

This seems to  be a known issue for the past few days with SEPM version below RU5.  Let us know if the upgrade was helpful in resolving this issue.

Cheers,
Aniket

had the same issue. I first deleted the tmp folders to get enough disk space for an upgrade, then upgraded to RU5. This resolved the issue, no more tmp folders....

martin

Hi,

i had the same issue. i deleted the tmp folders too and install RU5. Works...

TY

Yup, all better now, thanks for the help all.

Hey Guys,
Just an FYI
I noticed the same problem as this - upgrading to 11.0.5 seemed to help with the disk space problem but I also noticed that my definitions were not updating past December 31st.
I spoke to Symantec Support and they pointed me to this article:
service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010010308571348

Oh dear...so there's an ongoing bug there. 

Oh Symantec Admins, any way we can get on a notification list for when the next patch comes out to resolve this?

-c

subscribe to this post

https://www-secure.symantec.com/connect/forums/sepm-update

you will get updates about the progress,
or else i wil send you a Personal Message when the issue gets fixed..:)

This morning I have January 8 2010 r2 virus defs, so looks like you all fixed the date problem somehow, thanks.

 Clients taking Definitions directly from internet will show 2010 definitions.
Clients taking updates from SEPM will still show 12-31-2009 definitions as that hasn't been fixed yet.

I also moved to MU5 and the tmp file problem went away. However, now, if I start the "symantec management client service", users have very slow logons, the server loses connectivity, and users cannot see shares. If the service is stopped, this all goes away. How do I get smc to run without these other problems?

Okay so I have these same two problems that started in 2009 but were just caught on 1/9/2010.
We just spent two days rebuilding our Symantec environment here because Endpoint V11 has several known problems with workstations locking up.
It cost us two thousand in labor to reload all workstations last week and now because the clocked rolled into 2010, our system is screwed up again.
This is the most administrative intensive application on our network and it's become evident that Symatec is testing their software on our systems. How could a thorough beta program not turn up such significant bugs as lockups and temp file deletion problems?

We are running RU5 and the SESMVIRDEF64 folder is 10Gigs in size. Most tmp folders are created in January, not December. So it seems RU5 has the same problem the older releases have. Additionally, all definition dates show as 12.31.2009. I will manually delete temp files and manage virus definitions until Symantec proves the patch works. I'm not testing it here and creating more headaches. I will post the changes I make to workaround these limitations in the Symantec Endpoint 11 product.

 Hi SKTECH - The definition problem is a known problem that should get resolved in coming days..
That should resolve most of your issues refer this for more information on this
https://www-secure.symantec.com/connect/forums/official-status-sepm-definitions-stay-31-12-2009-last-updated-10-jan-2010

Does this issue exist with v12?  If I am going to do the upgrade I would prefer just to go straight to version 12 instead of RU5.  If so is there a link that discusses the migration from 11 to 12 similar to the one posted above from 11 to 11.0.5?

Hello I have the same Problem but I have Version 10.2 so I can not Upgrade to MU5 - any other solutions avaiable?

Greets Marc

Pls create a separate thread for your problem since this post is an old one most of the people will ignore it. 

Why do we always have to download the updates?  Can SEP update itself like every other piece of software out there?