Endpoint Protection

 View Only
Back to discussions
Expand all | Collapse all

Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

princer800

princer800Jan 12, 2010 03:01 PM

Ok, will get going tech going that direction
Migration User

Migration UserJan 13, 2010 01:20 AM

in VIsta and 2008 it will be C:\ProgramData
Migration User

Migration UserJan 14, 2010 11:41 PM

Definition has been fixed for MR5/RU5

  • 1.  Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 06, 2010 05:38 PM
    Since 1/1/2010 tmp*.tmp folders are being created and left in the c:\Program Files\Common Files\Symantec Shared\SymcData\ folders.  The sesmvirdaf64 tmp*.tmp folders have 100+ MB in every other folder.  This is causing about 1.2 GB per day of disk space to be used filling the C: drive on several servers.  I have removed the temp files, but would like a perminent solution. 

    I checked servers running 11.0.5002.333 and they did not have this issue.  Will Upgrading to version 11.0.5002.333 fix this issue?


  • 2.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 06, 2010 06:23 PM
     I have seen several cases of this in 2010. I have never seen this before 2010. This leads me to believe that it is related to the other 2010 definition issue.

    I have not seen this happen on any RU5 systems, including my own and several other co-worker's test environments.


  • 3.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 06, 2010 06:55 PM
     We believe this is related to an issue we fixed in RU5, which would cause 64 bit defs to be constantly downloaded.  It appears that a number of customers are seeing the same problem, and it may have been triggered by the current definition issue.  Upgrading to RU5 should fix it completely though.


  • 4.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 07, 2010 10:08 AM
    yep - we've just had this issue. I've delete 75.3GB of av definitions on one server that was down to 500k left on the c drive this morning! Yes in an ideal world we'd have caught this earlier but they don't pay for monitoring.
    Ironically they have no 64bit machines.

    Of course the other solution is to uninstall symantec and put ANY other av product in place.



  • 5.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 07, 2010 11:17 AM
    out of interest, which version of SEPM is your customer running?


  • 6.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 07, 2010 11:50 AM
    they're running 11.02. I'm not sure why it hasnt updated to 11.04. I'm in the process of getting the system upgraded to 11.05.
    There was approximately 70gb of data in the 64bit files and about 5 gb of data in the other directory locations. Some of the definitions were dated back in feb 2009 so there were a few old definitions but the vast majority of them were dated this year in tmp directory.


  • 7.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 07, 2010 12:21 PM
    Yes, this is an issue that has been fixed in later versions of the SEPM.  It seems that current definition issue may have triggered it in some situations, which is unfortunate, but the good news is that we aren't seeing any RU5 customers to date with the problem.

    If you do see an RU5 SEPM with this problem, please do let us know!


  • 8.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 07, 2010 12:30 PM
    Just an update that on another client with 11.0.4014.26 manager, on a 64 bit server, my C:\ProgramData\Symantec\Definitions\SymcData\sesmvirdef32 directory is 10gb with all tmp files being created from 1/3/2010 onwards.
    Strangely enough the sesmvirdef64 directory is 298mb.


  • 9.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 12, 2010 02:07 PM
    I have now seen this at two sites. Certainly started after the first of the year.
    One system had it on 64 bit defs - another on 32 bit.
    Clearly there is something wrong. The latest was on 11.0.4000.2295

    I have over 100 sites that we manage. While we are in the process (always) of upgrading systems that may not always be practical.

    Certainly you could provide a fix to this issue other than - our latest produsct don'thave this problem.


  • 10.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive



  • 11.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 12, 2010 02:35 PM
    So clearing tmp files makes sense. Of course as I said Ru5 udpate is not trivial excercise for our clients.
    So with no fix yet for the definition problem - how do I know I won't have to turn around and do RU6?

    I personaly haven't done a upgrade lately (just managing the problem) - can I just do Ru5 - easy upgrade over the top?
    In the past we have seen issues so leary that we'll spend hours to do what may sound like a trivial thing.


  • 12.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive



  • 13.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 12, 2010 03:01 PM
    Ok, will get going tech going that direction


  • 14.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 12, 2010 06:26 PM
    OK, starting the process. Of course the documentation doesn't match up for a W2008 64 Bit (SBS) install of SEP Manager.
    The .TMP files are not located anywhere near where it says.
    The documents and settings\all user - of course doens't even exist.
    So I cleared the lIve update cache.
    Be nice if Symantec would review the documentation for the 64 Bit platform.



  • 15.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 13, 2010 01:20 AM
     in VIsta and 2008 it will be C:\ProgramData


  • 16.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 13, 2010 08:24 AM
    Just be aware that when you do the upgrade to 11.0.5 you ensure that the packages are set to replace the settings on the machines. I don't think ours was set to do that on the initial update and our upgrade to 11.0.5 ended up a reinstall of the software on every single machine and server at the machine itself. Not an effective upgrade process at all.


  • 17.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 14, 2010 04:49 PM
    64bit definitions are stored in the following locations.
    c:\programdata\symantec\definitions\symcdata\
    c:\program files\symantec\symantec endpoint protection manager\data\inbox\content




  • 18.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 14, 2010 11:41 PM
    Definition has been fixed for MR5/RU5 


  • 19.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive
    Best Answer

    Posted Jan 16, 2010 06:46 PM
     Update 16-JAN-2010

    https://www-secure.symantec.com/connect/downloads/sepm-patch-definition-issue - video highlighting the Patch

    Patches for the following builds:

    SEPM MR3 (11.0.3001.2224)
    SEPM MR4 (11.0.4000.2295
    SEPM MR4 MP1 (11.0.4010.19)
    SEPM MR4 MP1a (11.0.4014.26)
    SEPM MR4 MP2 (11.0.4202.75)
    SEPM RU5 (11.0.5002.333)

    have been posted on the LiveUpdate servers.

    Reminder: Do not downgrade to get this patch.

    Please refer to the following KB document for details regarding this issue:

    http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010010308571348 


  • 20.  RE: Symantec Endpoint Protection Manager tmp*.tmp files in "C:\Program Files\Common Files\Symantec Shared\SymcData\" folders filling C: drive

    Posted Jan 16, 2010 09:00 PM
    The tmp file issue was made worse by 2009 problem. It is an issue that was fixed in MR4MP2 and newer versions of SEPM.

    JimW