SEPM Monitor Version: 1.3

1. Introduction
2. Installation and Configuration
3. Content Distribution
   
   • Latest versions available
   • Virus/Spyware content downloads today from SEPM(s)
   • Distribution Summary
   • Virus/Spyware online and out-of-date by Network/Client Group
   • IPS online and out-of-date by Network/Client Group
   • Potential Content load issues
   • Operational status of all GUPs
4. Site Information
5. Database
6. Troubleshooting
   

• Auto-refresh: This indicates whether the UI should be refreshed automatically or not. If it's enabled, user can specify the interval in minutes.
• Content thresholds: These settings are used to indicate the color convention used in Distribution Summary section. User can specify the thresholds in percentages. If the corresponding count falls below that percentage, it's displayed in red color, otherwise it's in green color.
• Low disk space limit: This is used to get the computers information whose free disk space is less than the configured setting. It's used in Potential content load issues and Operational status of GUPs.
• Low memory limit: This is used to get the computers information whose free memory is less than the configured setting. It's used in Operational status of GUPs.
• Out-of-date client: These settings are used by 1) Virus/Spyware online and out-of-date by Network/Client Group and 2) IPS online and out-of-date by Network/Client Group sections of the UI. The settings are used only for the display purpose.
• Show GUPs: This setting is used to display all the GUPs or only the Abnormal GUPs. A GUP is said to be abnormal if one of the following conditions are met:
  1. Offline
  2. Not having latest Virus/Spyware content
  3. Not having latest IPS content
  4. Low Disk space than the configured setting
  5. Low Memory than the configured setting
• Apache log path: This indicates the folders to be parsed by the SEPM Monitor to find the total content downloads (Full and delta). User should enable the Apache logging on the Servers to be monitored by SEPM Monitor and specify the folder paths (Ex: C:\Program Files\Symantec\Symantec Endpoint Protection Manager\apache\logs) seperated by semi-colons. All these folder paths should be accessible to the machine from where the SEPM Monitor is being run. This is used by the Virus/Spyware content downloads today from SEPM(s) section.
  Steps to enable Apache Logs on each SEPM server:
  1. Access SEP_INSTALL\apache\conf folder and take backup of httpd.conf file
  2. In httpd.conf file, enable access and error logging. Also set LogLevel to info.
     
     Error log: Uncomment #ErrorLog "|| bin/rotatelogs.exe logs/error-%Z.log 100M", change log file name format and log rotation to 24 hours. Modified line should be ErrorLog "|| bin/rotatelogs.exe logs/error-%Y-%m-%d.log 86400"
     
     Access log: Uncomment #CustomLog "|| bin/rotatelogs.exe logs/access-%Z.log 100M" combined, change log file name format and log rotation to 24 hours. Modified line should be CustomLog "|| bin/rotatelogs.exe logs/access-%Y-%m-%d.log 86400" combined
     
     LogLevel: Change LogLevel from warn to info. Modified line should be LogLevel info
     
     
  3. Restart the Apache (net stop semwebsrv and net start semsrv)
  Note: Apache doesn't purge the old logs. Admin needs to delete the old logs on each server (Can come up with a script to delete).

3) Content Distribution

• Latest versions available

  This section displays the Virus/Spyware, IPS and SONAR content versions available in SEPM database and Symantec Live Update server. It is also used to run the Live Update or access Rapid Release contents folder through the icons available at the top right corner of this section.
  
  

• Virus/Spyware content downloads today from SEPM(s)

  This section displays the total (Full and Delta) Virus/Spyware content downloads from the configured SEPMs. It gets the data by parsing the Apache logs configured at Apache log pathT. The data is based on the content downloaded from 12:00 AM (GMT) to current time.
  
  

• Distribution Summary

  This section displays the data for online clients only. It displays data for GUPs and Windows Clients that are having Latest Virus/Spyware and IPS.
  
  

• Virus/Spyware online and out-of-date by Network/Client Group

  This section displays the data for Online clients that are not having latest Virus/Spyware content. The user can display the data by Network or by SEPM group. The user can also export the entire data. These actions can be done by clicking on the corresponding icons which are at the top right corner of this section. Number of rows to be displayed can be configured at Out-of-date client view setting.
  
  

• IPS online and out-of-date by Network/Client Group

  This section displays the data for Online clients that are not having latest IPS content. The user can display the data by Network or by SEPM group. The user can also export the entire data. These actions can be done by clicking on the corresponding icons which are at the top right corner of this section. Number of rows to be displayed can be configured at Out-of-date client view setting.
  
  

• Potential Content load issues

  This section displays the total clients that are having Low disk space or missing/corrupted content. Low disk space is based on the configured Low Disk Space threshold. The user can also export the clients data by clicking on the export icon(s) in the last column of the table.
  
  

• Operational status of all GUPs

  This section displays all the GUPs information. User can toggle the display between All the GUPs or only Abnormal GUPs. The user can also export the entire data. These actions can be done by clicking on the corresponding icons which are at the top right corner of this section.
  
  

4) Site Information

5) Database

6) Troubleshooting