Disk Space Management for Downloads

[Bryon]

One of my SEPM servers is running out of disk space after we adjusted the "Disk Space Management for Downloads" setting. 

Here is my understanding of this setting and why it needs to be increased for us. This setting controls the number of revisions that a SEP managed client can look at before it requests a full definition download from the management server. At first or by default this setting was set to only keep 3 revisions. Our servers update every 4 hours and our clients update every 4 hours, so we get a number of revisions every day. We are a spread out company and some of our sites use T-1 connections. If one if the users at these sites goes on vacation, when they come back they request a full virus definition from the management server. As you know this file is anywhere between 55 and 75MB in size and when multiple people request this file from the same site it eats up all of the bandwidth.

I want to increase this number from 3 revisions to whatever it takes to make it 30 days without one of our clients requesting this file. I did the math, if we get 4 100MB revisions a day, I would need to increase my disk space by 12GB to accommodate this change. Is that correct? Because, that is the amount of disk space I increased our server to accommodate this change and it wasn’t large enough.  Am I missing something else that I need to add to my calculations?

I know this is going to be a large number of revisions to keep, but it’s better that our clients request 30 1k files when they come back on line than requesting a potential 75MB after 3 or 4 days.
 

[Rafeeq]

This should help you out which you said is correct

With default LiveUpdate content revision settings configured within the Symantec Endpoint Protection Manager, clients are downloading full definition updates instead of delta updates

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/68c0186409c1fc59652575ec004e9950?OpenDocument

[Migration User]

Check the articles below

Title: 'Best Practices for configuring the number of content revisions to keep in Symantec Endpoint Protection Manager'
Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2009020514050748?Open&seg=ent

Title: 'Disk Space Management procedures for the Symantec Endpoint Protection Manager'
Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2009091802033648?Open&seg=ent

[Migration User]

I want to increase this number from 3 revisions to whatever it takes to make it 30 days without one of our clients requesting this file. I did the math, if we get 4 100MB revisions a day, I would need to increase my disk space by 12GB to accommodate this change. Is that correct?
-----YES

Say the defintion is of 80  MB . Every day it released 3 times so every day the defs take 240 MB of space.

So for 30 days we will have 90 revision , so the space needed = 80*3*30 =7200 Mb= 7.0 GB approx.

[Bryon]

Ok, I've gone over the TIDs and it appears that I have the concept down.  We have 10k plus SEP clients on our network and I'm not sure why our default was set to 3.  If I increase this number to 30, that would give us roughly 10 days worth of revisions to keep.  Which means that I want to keep 90 revisions (30 days) on our SEPM's for a total disk space of (using a "buffer" of 100mb per revision) 90*100= 9GB.

Does anyone see anyway that we'd need more than 9GB?  Does Symantec send out mor than 3 revison a day, often?

[Rafeeq]

that you cannot say it depends on new threats and new signatures added to them, I think everday atleast you will have 3 rev
Have you configured your manager to get updates once in day or for 4 hours?

[Bryon]

every 4 hours

[Bryon]

Thanks for the assistance in clearing this up for me and quick responces! 

[Migration User]

Hi Bryon,

Just want to add some things here, before you find them out yourself.

We release no more than 3 sets of definitions every day - some days it may be less (particularly at weekends) but its never more than 3 per day at the moment.

Content sizes are increasing.  Todays latest download was 81.5MB.  Thats not the end of the story though.

In order to create the delta definitions to allow the clients to download small updates, we have to unzip that definition file and we store both on the disk.  That same zip file uncompressed is 126MB.  If we also make allowances for the storage of the created delta files, then its a safe assumption that each content download will actually take around 220MB.  Unfortunately, it doesn't finish there either because we also download 64 bit definitions.  These are roughly the same size. 

So, with that information, the math is I'm afraid a little more painful - 440MB * 3 = 1320MB per day

To use the same as Prachand, 440 * 3 * 90 = 118GB approx.

Typically, most customers go for the sweeter spot of 15 days, this allows for most peoples holidays and saves some space on the server.

440 * 3 * 45 = 60GB approx

Others take the view that bandwidth is expensive, storage is cheap and store even more sets than 90.

Hope I havent shocked you, but I dont want you to run out space again!

p.

[Bryon]

Paul, that is great information!! Unfortunenlty, I didn't see this post until we ran out of disk space again.

A follow up question for you.  If I reduce the number, say from 60 revisions to 40 revisions.  Do you think that should cause any issues for the WAN (knowing that the 41st revision request from a client would generate a request for the full.zip file)?

[Migration User]

HI Bryon,

Sorry for the delay, and sorry you ran out of space again :-(

Its difficult to say if it will cause you issues, without knowing your user base.  If you think that the majority of your users will be online at least one or twice over the course of 13.3 days then you should be OK.

Another option would be to have the clients themselves automatically run LiveUpdate once a day - that way, if they are out of the office, but connected to the Internet they could pull definitions from our LiveUpdate servers and keep themselves up to date.  When they come into the office, they will be more up to date and should reduce the load on your WAN.  You could also use location awareness to ensure that the clients only ran LiveUpdate when they were OUT of the office.

hth

p.

[Bryon]

Thanks for the information Paul.  I have our laptops group already setup the way you've suggested this is just for our local workstations.  We're tring to get to a 30 day grace period before the full.zip is sent.  We've just decided to change my SEPM2 to a physical box and throw disk space at it. 

As for your formula it seems that you're on the money, but their needs to be an additional 3GB per 10 revisions for the installation directory.

Thanks for the help!