I've been noticing that my 40 GB C: drive on the Windows 2008 Server keeps getting filled up. After investigation I found that this is a known issue with SEP described in article TECH180056 on symantec websit: Article URL http://www.symantec.com/docs/TECH180056 Symantec Endpoint Protection 12.1 is holding onto more than one set of definitions at a time, using up additional disk space.As of now definitions folder ballooned to over 9GB and keeps growing slowly with every update. The only way to fix this issue for me is to re-install SEP, but I can't do this since this is a critical server and downtime must be scheduled with great advance. When I'm trying ot remove old definitions it's saying access is denied despite my admin account. And I also can't change Read-only attribute to the folder. Does anyone have any idea how to delete old definitions?
How about contacting Symantec support or checking the Symantec FAQ/KB/Forums?– joeqwertyJul 30, 2013 at 15:22
This is a known issue in 12.1. You need to edit the \symantec endpoint protection manager\tomcat\etc\conf.properties' or upgrade to post 12.1 MP1. If you want to edit the config the value you want to look for is scm.lucontentcleanup.threshold. So if you only want to keep 5 days the value should look like:
Thanks for your reply.What do you mean by keep 5 days value? Jul 30, 2013 at 15:30
How long you wish to keep the definition files. The value is an integer for days (so if you wanted to keep them for a week then you'd use 7 instead of five, 30 for a month, etc...). I do believe you will need to restart the Symantec services and I would suggest a reboot just to be safe.– David VJul 30, 2013 at 16:25
That's the problem, server handles some critical bio-medical devices so I can't bounce it. The goal for me is to clean up old definitions to buy some time to schedule down time Jul 30, 2013 at 18:21
Just reading Symantec's KB on it they say just restarting the SEPM service should be enough. I just personally don't like to do those kind of changes without a reboot.– David VJul 30, 2013 at 18:46
I would recommend checking your SEP Console and determine how many content revisions you are keeping.
As far as deleting them manually, you most likely need to stop all Symantec related services which have handles on the folders. Download a tool like Process Explorer and find the handle / stop the process from running.
I do have process explorer on the server. The problem for me is that i'm keep getting Access Denied when attempting to remove the old definitions from the folder or remove Read-only attribute. I will try to stop all SEP processes to see if it is going to help me remove the folders. But at this point it looks like there are certain permission affecting the folder from Symantec side that prohibits me from deleting these folders. Jul 30, 2013 at 15:36