Endpoint Protection

Hello,

I am installing SAVFL 1.0 MR14 at a customer site. 

I cannot confirm from anywhere whether or not SAVFL uses delta virus definitions.

So, does SAVFL 1.0 MR 14 use virus definition deltas?

Thanks in advance!

Cheers,

Cameron

You can check this article by Mick2009:

https://www-secure.symantec.com/connect/articles/sav-linux-somewhat-illustrated-guide-part-3

It states:

"As long as the SAVFL client is updating every day, the files downloaded will be of manageable size. 

If the SAVFL client goes out-of-date by weeks, then a full set of definitions will need to be downloaded.  That can be a couple hundred MB."

So yes, this means it should use deltas unless it gets weeks out of date in which case it will than download the full set.

it uses delta however not the same delta as normal SEP windows one uses.

Hi Cameron,

"Thumbs up" to the above- SAVFL does not use the smallest, custom-generated updates generated by a SEPM for its SEP clients.  It uses the hubdefs and curdefs model that was designed back in SAV 10 days.  New SAVFL defs are released dailly.  These include protection against all known threats (threats that target Linux, Mac, Windows, everything).  These daily updates "top up" the existing protection on the SAVFL machine and should not be very large.

Please do let the forum know if this has answered your questions or if there is anything additional you need to know!  &: )

This series guides Linux fans through how to make the best use of SAV for Linux!  Given the rise of Linux threats and third-party vulnerabilities affecting this OS, please read….

• SAV for Linux Scanning Best Practices: A (Somewhat) Illustrated Guide covers the importance of auto-protect scanning, necessary scan exclusions and how to test them
• SAV for Linux: A (Somewhat) Illustrated Guide Part 2 provides examples of the various different ways in which SAVFL can be configured (by command line, by GRC.DAT and by xsymcfg).
• SAV for Linux: A (Somewhat) Illustrated Guide Part 3 focuses on how to keep SAV for Linux up-to-date.
• SAV for Linux: A (Somewhat) Illustrated Guide Part 4: SAVFL Reporter illustrates how to get some data and events from those isolated, unmanaged SAVFL clients into the Symantec AV's central management and reporting tool, the Symantec Endpoint Protection Manager (SEPM). 

Thanks y'all!

Cheers,

Cameron