SEPv11 - Disk Space requirements for client increases everyday it seems

[Migration User]

Testing SEPv11 for 6 month now and were seeing a bad trend. This is an example of what a lot of the clients I've checked are showing. We are currently on MR5 but these clients have been updated in the past (MR4 -> MR4 MP1 -> MR5). We use an internal LU server as well. This is getting crazy in terms of disk space. What's going on?

Over 550 MB - C:\Program Files\Common Files\Symantec Shared
Over 300MB - C:\Documents and Settings\All Users\Application Data
          ~ 280MB -  C:\Documents and Settings\All Users\Application Data\Symantec

[Migration User]

I've got another client that I just installed a fresh copy of SEP MR5. Only AV installed. Ran LU and the VirusDef folder consumes almost a Gig of space. I have 3 days of defs each with a different revision and the current day of defs (4/13).

My other client multiple days of defs folders as well. These are not temp folders.

[Migration User]

3 definitions set will be there and it cannot be decreased
SEP MR5 system reuirement for cliet says

Hard drive: 600 MB (32-bit), 700 MB (x64)
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009072315265848

[Migration User]

I'm right there with you.  504 MB in my c:\Program Files\Common Files\Symantec Shared and 384 MB in my C:\Documents and Settings\All Users\Application Data\Symantec.  that's why the current defs and 2 past revisions.

For our workstations, it is not a big deal as we have plenty of space, so I'll sacrifice a little HD space for all the benefits that I get out of it.  Servers are a different story, but disk space issues have been an issue with us forever, so this is just the latest to point out that we need to grow our OS volumes.

[Migration User]

In your original post you made it seem as though the space that SEP was taking up was increasing. Is this the case or were you concerned about the size SEP normally takes up? As stated above SEP should only take up about 600 MB or 700 MB depending on your OS. This is perfectly normal and somewhat expected from a program that offers the kinds of protection that SEP does. Usually even a gig is a somewhat small amount for most client machines, where you running out of disk space on your clients?

Grant-

[Migration User]

As discussed you will see 3 defs so that SEP can rollback and recover from corrupt defs etc.

Then you should have something similar to the following:

• 60MB - C:\Program Files\Symantec
• 20MB - C:\Program Files\Common Files\Symantec Shared

[Migration User]

I'm seeing more than 3 revisions of defs on my clients. I was exagerating a bit when I said growing everyday because the revisions being saved on these systems are the current three and then older dates as well. These older dates are random and not the same on each system. This is not as big of deal with one of our environments but we have tool PC's in our manufacturing facilities that don't have this kind of disk space. In fact SAV10 definitions sometimes put these systems to the edge on disk space.

Does anyone have a comparison of disk space requirements for SEP and SAV so I can compare?

I also think Symantec needs to rethink the "install all bits" strategy. Our manufacturing systems can only run AV and 450MB or more of disk space just for the core files is too much since they will never install the other SEP components.

[Migration User]

The SEP client itself is roughly 60MB under C:\Program Files

Then around 25MB under C:\Program Files\Common Files\Symantec Shared

What then takes the space is the AV definitions.  By default, the client will store the last 3 sets of definitions to enable it to rollback to an earlier version if there are problems, or if you instruct it to rollback from the SEPM.

Unfortunately, due to the large increase in defintion size over the last year (because of the massive number of variants and signatures that we are adding every day) the average size of an unpacked set of virus definitions is 120MB in size.

In addition, if you are using LiveUpdate, then that itself will be keeping a cache of the files you have downloaded.  By default, that is set to around 10% of your total drive size.  That cache size can be configured from the LiveUpdate control panel icon.

You can also control the number of revisions of virus definitions that the SEP client keeps by changing the registry entry HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\Content\{C60DC234-65F9-4674-94AE-62158EFCA433}\CacheEntriesEx

(The above assumes 32bit definitions)

Disk space usage for SAV and SEP will be similar at idle, and higher for SAV when it is updating, because SAV copies definitions, whereas SEP moves them, thereby reducing required space for updates and disk I/O during the update process itself.

hth