0

I've been noticing that my 40 GB C: drive on the Windows 2008 Server keeps getting filled up. After investigation I found that this is a known issue with SEP described in article TECH180056 on symantec websit: Article URL http://www.symantec.com/docs/TECH180056 Symantec Endpoint Protection 12.1 is holding onto more than one set of definitions at a time, using up additional disk space.As of now definitions folder ballooned to over 9GB and keeps growing slowly with every update. The only way to fix this issue for me is to re-install SEP, but I can't do this since this is a critical server and downtime must be scheduled with great advance. When I'm trying ot remove old definitions it's saying access is denied despite my admin account. And I also can't change Read-only attribute to the folder. Does anyone have any idea how to delete old definitions?

Improve this question
1
  • How about contacting Symantec support or checking the Symantec FAQ/KB/Forums?
    – joeqwerty
    Jul 30, 2013 at 15:22

2 Answers 2

Reset to default
1

This is a known issue in 12.1. You need to edit the \symantec endpoint protection manager\tomcat\etc\conf.properties' or upgrade to post 12.1 MP1. If you want to edit the config the value you want to look for is scm.lucontentcleanup.threshold. So if you only want to keep 5 days the value should look like:

scm.lucontentcleanup.threshold=5
Improve this answer
4
  • Thanks for your reply.What do you mean by keep 5 days value?
    – user176320
    Jul 30, 2013 at 15:30
  • How long you wish to keep the definition files. The value is an integer for days (so if you wanted to keep them for a week then you'd use 7 instead of five, 30 for a month, etc...). I do believe you will need to restart the Symantec services and I would suggest a reboot just to be safe.
    – David V
    Jul 30, 2013 at 16:25
  • That's the problem, server handles some critical bio-medical devices so I can't bounce it. The goal for me is to clean up old definitions to buy some time to schedule down time
    – user176320
    Jul 30, 2013 at 18:21
  • Just reading Symantec's KB on it they say just restarting the SEPM service should be enough. I just personally don't like to do those kind of changes without a reboot.
    – David V
    Jul 30, 2013 at 18:46
0

I would recommend checking your SEP Console and determine how many content revisions you are keeping.

http://www.symantec.com/connect/forums/define-number-content-revisions-keep-client-location

As far as deleting them manually, you most likely need to stop all Symantec related services which have handles on the folders. Download a tool like Process Explorer and find the handle / stop the process from running.

http://technet.microsoft.com/en-us/sysinternals/bb795533

Improve this answer
1
  • I do have process explorer on the server. The problem for me is that i'm keep getting Access Denied when attempting to remove the old definitions from the folder or remove Read-only attribute. I will try to stop all SEP processes to see if it is going to help me remove the folders. But at this point it looks like there are certain permission affecting the folder from Symantec side that prohibits me from deleting these folders.
    – user176320
    Jul 30, 2013 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.