I have the same problem with 2 separate clients. Both files are now over 9GB in size. I have an open case with support, but haven't heard back now in over two days. There is now way to truncate the log file in the SBE edition, only in Enterprise. Per technical support, "it's supposed to occur automatically every 4 hours.'
I have re-created the sem5.log file.
- Stop SEPM and database services.
- Rename the current sem5.log (C:\Program Files\Symantec\Symantec Endpoint Protection Manager\DB\)
- Click Start, click on Run and Type "CMD" then click OK
- In the Command Prompt type: "CD C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\ASA\win32\" and press Enter this will change directories to the folder containing dbsrv11.exe.
- To force the recreation of sem5.log. Type: dbsrv11 -f "C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\db\sem5.db" and press Enter
- Click Start, click on Run and Type "services.msc" then click OK and start the Symantec Embedded Database Service
- Start the Symantec Endpoint Protection Manager service
I have manually truncated the log file.
1 - Stop the Symantec Endpoint Protection services and the embedded database service
If SEPM is in a localized version might be located in another part of the services list.
2 - Truncate the Embedded Data Base Transaction log manually with the following command:
"%Programfiles%\Symantec\Symantec Endpoint Protection Manager\ASA\Win32\sem5.db"dbsrv11.exe -m
3 - Restart all Symantec Endpoint Protection Services disabled in step 1.
I have also unchecked most of the logging in SEPM.
Client logs can cause this file to grow to this size.
Check the firewall policy to see what rules are being logged.
- SEPM
- Policies
- Firewall
- Firewall policy
- Edit the policy
- Firewall Rules
- Customize the default settings
- Check the rules that have Log set to Yes
- Check if there is any rule set to YES for network packets and change it to No
Some of the rules that have log set to Yes can be causing the sem5.log to grow so large.
Nothing has fixed the problem of the ever growing sem5.log file