How the Endpoint Protection Manager knows when to provide a Full definition set to a client

Products

• Endpoint Protection

Issue/Introduction

How the Symantec Endpoint Protection Manager (SEPM) knows when to provide a full definition set versus Delta to a Symantec Endpoint Protection (SEP) client.

 

Resolution

How "out of date" the definition set is on a client, determines whether the SEPM will either forward a Full Definition set or a Delta (differential) package to the client.
.
As an example:
The SEPM is configured to keep 30 content revisions and obtains 3 content revisions per day (in total equivalent to approximately 10 days of revisions).
A client within the 10 day limit will be provided with a Delta package.

However, if the client is more than 30 content revisions "out of date", then the SEPM will provide a full definition set.

The recommended default number of revisions to store is "90", but there is no upper limit to the amount of content revisions a SEPM can store or its ability to create Delta packages.
However, when the number of revisions maintained exceeds "90", at some point a Delta package will be approximately the same size and take the same amount of bandwidth as a Full definition set.

The delta files will be created in the newest revision folder, for example:
"C:\Program Files\Symantec Endpoint Protection Manager\Inetpub\content\{C60DC234-65F9-4674-94AE-62158EFCA433}\110123003" and will remain there until the revision is removed by SEPM. The folder itself is made up of many Delta files with different sizes because the SEPM will create different Deltas for clients that have with differing revisions installed.

 

 

Additional Information

The number of content revisions can be seen or modified from the SEPM.  Select Admin -> Servers -> Local Site -> Edit Site Properties, then select the LiveUpdate tab. This setting is configured in the field Number of content revisions to keep