ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Numerous .SLG files are getting created in the Symantec Endpoint Protection Manager Database folder


Article ID: 155165


Updated On:


Endpoint Protection


When the out.log gets larger than 1 MB it creates a file with the date that it was create having an extension of slg.  These files may not be cleaned up by regular SEPM maintenece activities.

An example from a 32-bit SEPM installed using default locations:  

C:\Program Files\Symantec\Symantec Endpoint Protection Manager\db
11093000.slg                  <-- unexpected / should not be present
11093001.slg                  <-- unexpected / should not be present 
11093002.slg                  <-- unexpected / should not be present 
11100100.slg                  <-- unexpected / should not be present 
11100101.slg                  <-- unexpected / should not be present 
11100102.slg                  <-- unexpected / should not be present 
11100200.slg                  <-- unexpected / should not be present 
11100201.slg                  <-- unexpected / should not be present 
11100300.slg                  <-- unexpected / should not be present 
11100301.slg                  <-- unexpected / should not be present 
11100302.slg                  <-- unexpected / should not be present 
11100400.slg                  <-- unexpected / should not be present 
out.log                        <-- correct / should be present
out.log.old                 <-- correct / should be present 
sem5.db                    <-- correct / should be present 
sem5.log                   <-- correct / should be present 




The *.slg files are being created as a backup of the out.log in the "....\Symantec\Symantec Endpoint Protection Manager\db" folder.  Each backup is created with a file name referencing the date stamp and number of files created that day, leaving multiple copies in the folder. When the database is backed up, these files are also backed up.  In previous version of SEP these files were not created.


This issue has been fixed in Symantec Endpoint Protection 12 Release Update 1 (RU1) Maintenance Patch 1 (MP1).  For information on how to obtain the latest build of Symantec Endpoint Protection, read TECH 103088: Obtaining an upgrade or update for Symantec Endpoint Protection or Symantec Network Access Control

If you are unable to upgrade, these files can be deleted manually as they are just log files.

To work around the issue and stop the creation of the numbered SLG files please do the following:

  1. Locate the following registry key HKLM\SYSTEM\CurrentControlSet\Services\SQLANYs_sem5\Parameters
  2. Edit the string value Parameters
  3. Locate the value "-os" inside the string value data and change it to "-on"

This will restore log retention functionality to the legacy SEP 11 operation.