C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\inbox\log\traffic filling up with .DAT files

[Migration User]

Our SEPM server continues to run out of Hard Drive space because of "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\inbox\log\traffic" filling up with .DAT files. Could anyone shed some light on what might be cause this? We have made no changes to our system or Policies. This issue started occuring yesterday. There are no unusual events logged in our Event Viewer.

[Rafeeq]

what is the version of sepm you are running, it was a bug in earlier version

ymantec Endpoint Protection Manager "AgentInfo" folder fills with multiple .DAT files.
Fix ID: 1261236
Symptom: Symantec Endpoint Protection Manager "AgentInfo" folder fills up with .DAT event files.
Solution: Symantec Endpoint Protection Manager now better processes the events sent by the client so the folder will not fill up.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid_p/2007121216360648 

[Migration User]

 Migrate your SEPM to RU5/11.0.5002.33

[Migration User]

We are running 11.0.4014.26. My next question would be why did this all of a sudden occur? We have been up and running on this platform for a good while.

[Rafeeq]

Bug :) cant help , upgrading will be the best option
the problem is with .dat files not getting processes this leaves incorrect data about client and also left out files.

Migrating to Symantec Endpoint Protection 11.0 RU5
http://service1.symantec.com/support/ent-security.nsf/docid/2009090313483348

Upgrading clients by using AutoUpgrade

http://seer.entsupport.symantec.com/docs/330686.htm 

[Migration User]

This must have been an ongoing issue but you might have noticed it after your HardDisk was full. 

[Migration User]

Is the upgrade process the only way to resolve this issue short term. Ideally we are going to upgrade ASAP, but we have set policy where things have to be tested before putting into production. This will take time in other words.

Also this just did start happening yesterday per the date on the .dat files that have accumulated. Is it possible to purge these files in order to free up some space?

[Rafeeq]

you can purge them for time being
Stop symantec manager service and sep service and delete all the .dat files 

https://www-secure.symantec.com/connect/forums/low-server-disk-space-due-millions-dat-files-agentinfo-folder

[Migration User]

Before deleting these I want to make sure that the wrong assumption didnt get made at the beginning of the thread. I am acquiring about the path "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\inbox\log\traffic" the thread above "https://www-secure.symantec.com/connect/forums/low-server-disk-space-due-millions-dat-files-agentinfo-folder" talks about clearing .dat files out of the AgentInfo directory. Just wanted to make sure that it applies to my issue.

[Migration User]

 in SEPM - Admin- Servers- local site -properties- Log Settings
50,000 entries change that to 10,000 or 5000
The traffic Logs would be set for 60 days change that to 10 days
Then it should bring down the size.

[Migration User]

Vikram thanks for the heads up on the location of the settings, but unfortunatley in our case i dont believe this would  work. There are 3 .dat files being generated every minute. Even if I set the logging threash hold to 5 days we would still run out of disk space.  We need to determine why these all of a sudden started being populated so that we can correct this issue.

Can anyone tell me what these .dat files are used for and why they might be stacking up like they are?

[Rafeeq]

these are  info about the clients would upload to the manager, as paul mentioned these are generally large ,SEPM should read and purge them , not sure why it got populated all of a sudden, may be the SEPM cant read  now , corrected in later versions

[Rafeeq]

whats your communication setting, is it in push mode or pullmode?
check this for the frequency of data which is uploaded.
https://www-secure.symantec.com/connect/forums/heart-beat 

[Migration User]

We are using both modes on different groups/policies. Is there a service that handles processing these files that we might be able to stop and restart. It seems since this just started occuring that maybe something got hung up and just needs to be restarted so that these will process again.

[Rafeeq]

its semsrv.exe symantec  manager service,
you can try deleting the .dat files and then run the management server config wizard, worked for me once...long before. 

[Migration User]

Rafeeq I tried your solution, but no go. I have opened a support ticket into Symantec so hopefully they can shed some light on the issue. 

[Migration User]

If you are using SQL server as SEPM database then you might need to re-install SQL agent.
If you have any Group Policy applied on SEP services then you've got to remove it.