Endpoint Protection

Hi,

I have noticed that SEPM 12.1.3 installation has huge 'content' folder with specifically 14GB+ size on the following subfolders.

{535CB6A4-441F-4e8a-A897-804CD859100E}

 {07B590B3-9282-482f-BBAA-6D515D385869}

This has never seen mentioned in the Sizing and Disk Space best practices guide. (refering to rev.2.3)

What is this 14+ GB content and how can we reduce is?

Kindly give suggestions.

regards /Antony

Reduce the size of the content to keep in SEPM console

1. In the Symantec Endpoint Protection Manager console, click Admin > Servers > Local Site.
2. Right-click Local Site and select Edit Properties.
3. Click LiveUpdate.
4. Under "Disk Space Management for Downloads", select the number of content revisions to be retained.

Once you change this value, say 3, the older ones will be purged automatically 

or follow the document to clear the corrup defs for SEPM

http://www.symantec.com/business/support/index?page=content&id=TECH104721

Hi Follow the above post and set the how much number of content you want to keep.

How many content revisions are you keeping? You may want to lower this number.

Hi

please check this below link

check this article

Disk Space Management procedures for the SEPM
http://www.symantec.com/business/support/index?page=content&id=TECH96214
 

How to change the number of revisions retained by the Symantec Endpoint Protection Manager:
Login to Symantec Endpoint Protection Manager
Click on the Admin tab
Click on Servers
Right-click on Local Site and choose Edit Properties
Click on the LiveUpdate tab
At the bottom under "Disk Space Management for Downloads" you can alter the number of content revisions to keep
Click OK

Hello,

Please go through with below article.

http://www.symantec.com/business/support/index?page=content&id=TECH96214&profileURL=https%3A%2F%2Fsymaccount-profile.symantec.com%2FSSO%2Findex.jsp%3FssoID%3D137570169431084yOz9G3cb2NF9r3PnWG02f59EEFi24GRP3M8

Thanks All,

I am very specific on the following.

I have setting and keeping 20 content vesions.

Pls note; under the Installation path\Content we have 22 folders. 2 are the the default (mentioned in my initial post) and 20 others are the content versions.

These 20 others, I can manage fom the settings, to reduce to 10 content versions..

But how to manage that defaut two folders with 14+ GBs

Dear Antonyma,

Please check this article

Disk Space Management procedures for the SEPM
http://www.symantec.com/business/support/index?page=content&id=TECH96214

The two mentioned folders:

{535CB6A4-441F-4e8a-A897-804CD859100E}

{07B590B3-9282-482f-BBAA-6D515D385869}

...are Virus Definitions for SEP 12.1 32bit and 64bit clients.

Each of the subfolders in these folders will be one specific virus definition revision. As for the sizing for each revision SEPM stores full.zip file (around 200-250MB) and extracted "Full" folder (around 450MB) - altogether one revision takes then around 650-700MB + additional space if there are any delta definitions files inside (.dax) - this needs to be mupltiplied by factor of 2x - as per 32bit and 64bit definitions stored.

As you are keeping 20 revisions - 1.3/1.4GB x 20 = the content folders for the AV defs only may increase in size up to 26 GB / 28 GB and this is expected.

All other moniker folders under .../inetpub/content/ beside the two already mentioned are other definitions - SONAR, PTP, NTP etc.

To decrease the size on the content folder you will need to decrease the amount of stored revisions on SEPM. Please note that the inetpub/content folder is mirrored to the content stored on the database - which will require the approx. same amount of space in the FG_CONTENT group.

Hi,

By default the Symantec Endpoint Protection Manager downloads and keeps a particular number of virus definition revisions in its repositories based on the type of install performed:

o    Simple: A management server that manages fewer than 100 clients and uses an embedded database.

§  3 revisions
              

o    Advanced: A management server that manages more than 100 clients or if you want to customize the configuration.

§  Between 100 and 500 = 3 revisions

§  Between 500 and 1,000 = 10 revisions

§  More than 1,000 = 30 revisions
              
This number can be lowered to help reduce the amount of disk space that is used by content revisions. The Symantec Endpoint Protection Manager must have previous content revisions stored in order to create a "delta", or differential, capable of updating a client from its version of that content type to the most recent type. For detailed information on how to determine how many content revisions to keep see the following

How to change the number of revisions retained by the Symantec Endpoint Protection Manager:

1.    Login to Symantec Endpoint Protection Manager

2.    Click on the Admin tab

3.    Click on Servers

4.    Right-click on Local Site and choose Edit Properties

5.    Click on the LiveUpdate tab

6.    At the bottom under "Disk Space Management for Downloads" you can alter the number of content revisions to keep

7.    Click OK

How to edit the database retention settings for the Symantec Endpoint Protection Manager to help save disk space:

1.    Log in to the Symantec Endpoint Protection Manager

2.    Click on the Admin tab

3.    Click on Servers

4.    Right-click on Local Site and choose Edit Properties

5.    Click on the Database tab

6.    Edit the retention settings here as desired

7.    Click OK

Regards

Ajin

Hi SebastianZ,

Your reply explains the fact very well.

So the initially mentioned folders under .../inetpub/content/  contain AV definitions and its various versions.

Other subfolders there contain other definitions - SONAR, PTP, NTP etc.

This is a great information. **

I wonder why one content version takes 1.3 /1.4 GB ??

 SONAR, PTP, NTP are not updated daily and the defs size are not huge

AV/AS are the main component and they are released every day so there is increase in size depending on how many defs revision you want to keep. This setting is as explained in my first link.

can you browse the path of the content and post the screen shot?

As mentioned the size 1.3/1.4 GB is here split between two mirrored versions 32bit /64bit - the definitions itself take around 250MB zipped + 450MB unzipped for SEPM to process the files for delta defs - this is the size of the virus signatures included in it - and it is increasing for any new revision a bit as new signatures is being added. Nothing we can really do about the size of it - possible in the future relases those will be compressed somehow to limit this size a bit.

About the different folders under  inetpub/content - you can check yourself what they exactly are by opening the contentinfo.txt file on your sepm - located in:

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Inetpub\content\contentinfo.txt

From my test machine an example - should be quite similar in your case - the monikers don't change you may have only few less or more depending on what defs your sepm has available:

{535CB6A4-441F-4e8a-A897-804CD859100E}: SEPC Virus Definitions Win32 12.1 RU2 H - MicroDefsB.CurDefs - SymAllLanguages
{07B590B3-9282-482f-BBAA-6D515D385869}: SEPC Virus Definitions Win64 (x64) 12.1 RU2 H - MicroDefsB.CurDefs - SymAllLanguages
{50B092DE-40D5-4724-971B-D3D90E9EE987}: SEPC SRTSP Settings - 12.1 RU2 - SymAllLanguages
{C13726A9-8DF7-4583-9B39-105B7EBD55E2}: SEP PTS Engine Win32 - 6.1.0 - SymAllLanguages
{DB206823-FFD2-440a-9B89-CCFD45F3F1CD}: SEP PTS Engine Win64 - 6.1.0 - SymAllLanguages
{EA960B33-2196-4d53-8AC4-D5043A5B6F9B}: SEP PTS Content - 6.1.0 - SymAllLanguages
{D6AEBC07-D833-485f-9723-6C908D37F806}: SEPC Behavior And Security Heuristics 12.1 RU2 - MicroDefsB.CurDefs - SymAllLanguages
{C25CEA47-63E5-447b-8D95-C79CAE13FF79}: Symantec Known Application System - 1.5.0 - SymAllLanguages
{812CD25E-1049-4086-9DDD-A4FAE649FBDF}: Symantec Security Content A1 - MicroDefsB.CurDefs - SymAllLanguages
{E1A6B4FF-6873-4200-B6F6-04C13BF38CF3}: Symantec Security Content A1-64 - MicroDefsB.CurDefs - SymAllLanguages
{E5A3EBEE-D580-421e-86DF-54C0B3739522}: Symantec Security Content B1 - MicroDefsB.CurDefs - SymAllLanguages
{CC40C428-1830-44ef-B8B2-920A0B761793}: Symantec Security Content B1-64 - MicroDefsB.CurDefs - SymAllLanguages
{D3769926-05B7-4ad1-9DCF-23051EEE78E3}: SESC IPS Signatures Win32 - 11.0 - SymAllLanguages
{42B17E5E-4E9D-4157-88CB-966FB4985928}: SESC IPS Signatures Win64 - 11.0 - SymAllLanguages
{55DE35DC-862A-44c9-8A2B-3EF451665D0A}: SEPC CIDS Signatures 12.1 RU2 - MicroDefsB.CurDefs - SymAllLanguages
{4F889C4A-784D-40de-8539-6A29BAA43139}: SESC Submission Control Data - 11.0 - SymAllLanguages
{B6DC6C8F-46FA-40c7-A806-B669BE1D2D19}: SEPC Submission Control Data - 12.1 RU2 - SymAllLanguages
{EDBD3BD0-8395-4d4d-BAC9-19DD32EF4758}: SEPC Iron Whitelist 12.1 RU2 - MicroDefsB.CurDefs - SymAllLanguages
{810D5A61-809F-49c2-BD75-177F0647D2BA}: SEPC Iron Revocation List 12.1 RU2 - MicroDefsB.CurDefs - SymAllLanguages
{263395A0-D3D8-4be4-80B5-202C94EF4AA0}: SEPC Iron Settings 12.1 RU2 - MicroDefsB.CurDefs - SymAllLanguages
{E8827B4A-4F58-4dea-8C93-07B32A63D1C5}: SEPC Extended File Attributes and Signatures 12.1 RU2 - MicroDefsB.CurDefs - SymAllLanguages