Endpoint Protection

 View Only

Shared Inside Cache with SEP 12.1 

Aug 12, 2011 07:46 AM

Updated on 23rd Oct'12

 

Hi,

Shared Insight Cache (SIC) is a server application which caches known clean files in order to optimize scan performances.SIC server is mainly designed for virtual environment but usage on physical system is supported given that network latency is kept at an absolute low.SIC server keeps a record in memory (ram) of files which are voted clean by system performing scans 

First SEP client needs to scan a file.  Queries SIC and finds no record.  SEP scans the file and sends the results to the SIC.

Subsequent SEP clients need to scan the same file.  They query the cache server and find the file has already been scanned with the same version of defs and the file is clean.  SEP client skips scanning the file.

When a second client run the scan it goes though the same process and since the file is cached on the SIC therefore will skip the scan. 

Shared Insight Cache is only available for the clients that perform scheduled scans and manual scans. 

Shared Insight Cache runs independently of Symantec Endpoint Protection. However, you must configure Symantec Endpoint Protection Manager to specify the location of Shared Insight Cache so that your clients can communicate with Shared Insight Cache. No special license is required to install or run Shared Insight Cache.

The tool is located on SEP 12.1 DVD under 
\Tools\SharedInsightCache
 
Helpful Links:

Symantec Endpoint Protection Shared Insight Cache User Guide 12.1

http://www.symantec.com/docs/DOC4334

Shared Insight Cache - Best Practices and Sizing guide

http://www.symantec.com/business/support/index?page=content&id=TECH174123

Installation and Configuration of SEP Shared Insight Cache

http://www.symantec.com/docs/TECH185897

Viewing Shared Insight Cache events in the Cache Server log

http://www.symantec.com/docs/HOWTO55316

How Shared Insight Cache works

http://www.symantec.com/docs/HOWTO55318

About the Symantec Endpoint Protection Shared Insight Cache tool

http://www.symantec.com/docs/HOWTO55311

Customizing Shared Insight Cache settings

http://www.symantec.com/docs/HOWTO55314

 

Statistics
0 Favorited
1 Views
0 Files
0 Shares
0 Downloads

Tags and Keywords

Comments

Oct 05, 2012 02:46 AM

Hello Everyone,

SIC server counters are availables as a part of the windows performance monitor.

You can add counter in text form.

 

 

Review of SIC counters

Go to the detail of the first scan

 

Go to the details of Second Scan

You can monitor the difference here.

 

 

Oct 04, 2012 05:43 PM

I would love to see a report in the SEPM showing me how many clients are using the SIC. Showing number of cache submits, requests, trusted files etc...

Oct 04, 2012 08:19 AM

Why is there no built-in utility to report on SIC?

Oct 04, 2012 08:18 AM

Same question:

How can I tell if my SEP client has contacted the SIC Server? I'm running this in a test environment fopreparing for rollout to Production . I have gone through the steps to enable this in the policy and configure the server, but is there a way to tell on the client machine if it is talking to the SIC Server? How and what should I look for using Perfmon?

Oct 01, 2012 12:45 PM

I am going to post the exact same question from the exact same situation.

How can I tell if my SEP client has contacted the SIC Server? I'm running this in a test environment fopreparing for rollout to Production and I know to look at perfmon for items in the cache and hits etc. I have gone through the steps to enable this in the policy and configure the server, but is there a way to tell on the client machine if it is talking to the SIC Server?

Sep 24, 2012 05:04 PM

How can I tell if my SEP client has contacted the SIC Server? I'm running this in a test environment fopreparing for rollout to Production and I know to look at perfmon for items in the cache and hits etc. I have gone through the steps to enable this in the policy and configure the server, but is there a way to tell on the client machine if it is talking to the SIC Server?

Related Entries and Links

No Related Resource entered.