ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

What happens every X minutes in Endpoint Protection Manager

book

Article ID: 155235

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

What tasks does the Symantec Endpoint Protection Manager (SEPM) run, and at what default times?

Resolution

 

Multiple timers are created on the SEPM server to schedule server tasks. Individual timers (Java threads) execute one or more tasks. When more than one task is scheduled on a single timer, the tasks can delay each other.

Fixed-delay task:
In fixed-delay execution, each execution is scheduled relative to the actual execution time of the previous execution. If an execution is delayed for any reason (such as garbage collection or other background activity), subsequent executions will be delayed as well. In the long run, the frequency of execution will generally be slightly lower than the reciprocal of the specified period.

Fixed-rate task:
In fixed-rate execution, each execution is scheduled relative to the scheduled execution time of the initial execution. If an execution is delayed for any reason (such as garbage collection or other background activity), two or more executions will occur in rapid succession to "catch up." In the long run, the frequency of execution will be exactly the reciprocal of the specified period.

1) Critical Timer:

Task

Initial Delay

Frequency

Description

Type

Product

StateCheckpointTask

1 second

1 minute

Updates the Server State. Also updates the default server list if IP address is changed.

Fixed delay task

SEP11.x & SEP12.x

 

2) Notification Timer:

Task

Initial Delay

Frequency

Description

Type

Product

SecurityAlertNotifyTask

10 minutes

scm.securityalertnotifytask.notification.interval(default 10 minutes)

When this task is running, it checks the current server see it is a reporting server of local site. It will process the notification only if it’s a reporting server. Once the notification condition occurs, then it will trigger SEPM to run a batch or executable file or send email to admin etc. It’s up to the configuration when adding a new notification condition.

Fixed delay task

SEP11.x & SEP12.x

 

3) Compiler Timer:

Task

Initial Delay

Frequency

Description

Type

Product

PackageTask

2 seconds

2 seconds

Publishes the client packages and compiles the policy profile.

Fixed delay task

SEP11.x & SEP12.x

GupListPublishTask

0 seconds

scm.guplistupdatefrequency.seconds (default 60 seconds)

Publishes the GUP List if there is any change at DB table GUP_LIST.

Fixed delay task

SEP11.x & SEP12.x

EnforcerCompilerTask

5 seconds

30 seconds

Compiles Enforcer profile if SNAC license is present. At SEP12.x, this task will compile profile for all enforcers across all sites. At SEP11.x, it only compile profile for local site.

Fixed delay task

SEP11.x & SEP12.x

 

4) Log File Timer:

Task

Initial Delay

Frequency

Description

Type

Product

AgentLogCollector

10.5 seconds

scm.timer.logcollection (default 60 seconds)

Processes the client logs.

Fixed delay task

SEP11.x & SEP12.x

ApplicationCollector

300 seconds

scm.timer.appcollection (default 3600 seconds)

Gets info about learned apps from clients configured to provide that info.

Fixed delay task

SEP11.x & SEP12.x

 

5) Agent Info Timer:

Task

Initial Delay

Frequency

Description

Type

Product

AgentInfoTask

11 seconds

scm.timer.agentstatus (default 120 seconds)

Processes OpState from clients and Enforcer server.

Fixed delay task

SEP11.x & SEP12.x

 

6) Scheduler Timer:

Task

Initial Delay

Frequency

Description

Type

Product

RequestHandlerCacheRefreshTask

5 seconds

5 seconds

Refreshes the internal object cache. This is used for performance improvement.

Fixed delay task

SEP12.x

EmailPackagePurgeTask

7 days

7 days

Deletes the email packages (under Inetput/EmailPackages folder).

Fixed delay task

SEP12.x

ScheduledReportingTask

10 minutes

scm.securityalertnotifytask.notification.interval(default 10 minutes)

Generates the scheduled reports, and send reports to admin via Email. If the current server is not a reporting server, then this task will skip to execute.

Fixed delay task

SEP12.x

 

7) Telemetry Scheduler Timer:

Task

Initial Delay

Frequency

Description

Type

Product

TelemetryDataTask

if (enableDelay)
10% of Frequency + random minutes (0 to 200)
else 0
/* enableDelay = true by default */

configured number of days (default 7 days)

Collects the Telemetry data

Fixed rate task

SEP11.x & SEP12.x

 

8) Fast Timer:

Task

Initial Delay

Frequency

Description

Type

Product

ClientTransportInfoTask

10 seconds

10 seconds

GetSyServerInfo - Query Secars for state info including throughput. This task also calculate the site health status base on the server.

If the DB is down, then this task will skip to execute. If license is invalid or the DB data is crashed, then this task will shutdown the SEPM server.

Fixed delay task

SEP11.x & SEP12.x

AgentOnlineStatusTask

2 seconds

20 seconds

Updates the agents online status by getting the data from Secars

Fixed delay task

SEP11.x & SEP12.x

IISCacheTask

1 second

scm.timer.iiscache (default 120 seconds)

Updates Agent, command and enforcer cache in Secars

Fixed delay task

SEP11.x & SEP12.x

IdentitySynchronizeTask

3 seconds

5 minutes

Updates the Identity cache by getting data from IDENTITY_MAP table

Fixed delay task

SEP11.x & SEP12.x

PackageUpdateTask

10 seconds

1 minute

Used in SBE only

Fixed delay task

SEP12.x

SyncLuConfigTask

30 seconds

3 seconds

Writes the LU hosts info for Liveupdate to act up on

Fixed delay task

SEP11.x & SEP12.x

 

9) Slow Timer:

Task

Initial Delay

Frequency

Description

Type

Product

ReportDataTask

Beginning of the next hour

1 hour

Generates reports and inserts data into History table

Fixed rate task

SEP11.x & SEP12.x

FailedEmailResendingTask

1 hour

24 hours

Resends all the failed email messages

Fixed rate task

SEP12.x

LicenseComplianceCheck Task

Mid night

scm.timer.license ( default 24*60*60 seconds)

Checks for license expiration and over deployment

Fixed rate task

SEP12.x

LicenseManagerTask

1 minute

15 minutes

Checks and restores the license states

Fixed rate task

SEP12.x

AjaxSwingTempCleanupTask

1 minute

1 week

Cleans up ajaxswing temp folder

Fixed rate task

SEP12.x

ADSITask

3 seconds

scm.timer.activedirectory(default 60*60 seconds)

Does active directory sync

Fixed delay task

SEP11.x & SEP12.x

SecurityDataTask

1 minute

4 hours

Processes Virus categories and ThreatCon

Fixed delay task

SEP11.x & SEP12.x

 

10) External Log Timer:

Task

Initial Delay

Frequency

Description

Type

Product

ExternalLoggingTask

10 seconds

1 minute

Sends logs to Syslog Server and export logs to a dump file

Fixed delay task

SEP11.x & SEP12.x

 

11) Backup Timer:

Task

Initial Delay

Frequency

Description

Type

Product

BackupSchedulerTask

20 seconds

1 minute

Backup the database

Fixed delay task

SEP11.x & SEP12.x

 

12) Update Timer:

Task

Initial Delay

Frequency

Description

Type

Product

LiveUpdateTask

5 minutes

1 minute

Runs the Liveupdate

Fixed delay task

SEP11.x & SEP12.x

PackageCleanupTask

Max (60*60 seconds, scm.packagecleanup.delay)

Max (24*60*60 seconds, scm.packagecleanup.period)

Deletes the packages in SBE only

Fixed delay task

SEP12.x

DeltaContentTask

6 seconds

scm.timer.ludelta (default 2 seconds)

Generates the delta between contents

Fixed delay task

SEP11.x & SEP12.x

DeltaPackageTask

6 seconds

scm.timer.ludelta (default 2 seconds)

Generates the delta between packages

Fixed delay task

SEP11.x & SEP12.x

RapidResponseContentTask

5 seconds

10 seconds

processes jdb abd vdb files

Fixed delay task

SEP11.x & SEP12.x

 

13) Data Mining Timer:

Task

Initial Delay

Frequency

Description

Type

Product

SecurityMiningTask

11.5 seconds

scm.timer.securitymining(default 60 seconds)

Inserts data into SEM_COMPLIANCE_CRITERIA table based on the Host Integrity data in AGENT_SECURITY_LOG_1(2)

Fixed delay task

SEP11.x & SEP12.x

 

14) DB Maintenance Timer:

Task

Initial Delay

Frequency

Description

Type

Product

TruncateTxnLogTask

10 minutes

10 minutes

Truncates the transaction logs

Fixed delay task

SEP12.x

RebuildIndexesTask

10 minutes

10 minutes

Rebuilds the indexes

Fixed delay task

SEP12.x

 

15) Temp Log Timer:

Task

Initial Delay

Frequency

Description

Type

Product

AgentTrafficLogCollector

12.5 seconds

scm.timer.logcollection (default 60 seconds)

Processes log data from inbox/log/traffic

Fixed delay task

SEP12.x

AgentSecurityLogCollector

13.5 seconds

scm.timer.logcollection (default 60 seconds)

Processes log data from inbox/log/security

Fixed delay task

SEP12.x

 

16) AV Log Timer:

Task

Initial Delay

Frequency

Description

Type

Product

AgentAVLogCollector

11.5 seconds

scm.timer.logcollection (default 60 seconds)

Processes log data from inbox/log/tex

Fixed delay task

SEP12.x

 

17) GC Timer:

Task

Initial Delay

Frequency

Description

Type

Product

GarbageCollectorTask

5 minutes

5 minutes

Cleans up internal object cache and runs the JVM garbage collector

Fixed delay task

SEP11.x & SEP12.x

 

18) Agent Sweeping Timer:

Task

Initial Delay

Frequency

Description

Type

Product

AgentSweepingTask

scm.timer.objectsweep or midnight

scm.timer.objectsweep (default 24*60*60 seconds)

Purges the expired/stale data

Fixed rate task

SEP11.x & SEP 12.0

 

 

Task

Initial Delay

Frequency

Description

Type

Product

AgentSweepingTask

scm.timer.objectsweep.delay or midnight

scm.timer.objectsweep.delay (default 24*60*60 seconds)

Purges the expired/stale data

Fixed rate task

SEP 12.1

 

19) Status Timer:

Task

Initial Delay

Frequency

Description

Type

Product

AgentLastCheckInTask

120 seconds

scm.timer.lastcheckin (default is 120 seconds)

Updates the client's last update time in sem_agent table based on the data from Secars

Fixed delay task

SEP11.x & SEP12.x

 

20) Replication:

Task

Initial Delay

Frequency

Description

Type

Product

ReplicationTask

Console UI configuration. (default is 120 minute for SEP12.x, default is 5 minutes for SEP 11.x)

Console UI configuration. (default is 120 minute for SEP12.x, default is 5 minutes for SEP 11.x)

Run replication between local site and remote partner. It will be scheduled via Console operation at replication environment.

Fixed delay task

SEP11.x & SEP12.x

ReplicationCancelTask

0

N/A

Cancel the replication task between local site and remote partner. Run it immediately.

Fixed delay task

SEP11.x & SEP12.x

 

21) Secars Task:

Task

Initial Delay

Frequency

Description

Type

Product

PushEventMonitor

0

2 seconds at SEP12.x, 0.5 second at SEP11.x

This task works under push mode. Travel every group push status, if the close flag is true, then push all agent connections to queue for termination. Check the command table, if this table has commend, then find corresponding agent state, push its connection to queue for termination.

Fixed rate task

SEP11.x & SEP12.x

ConnExpiredMonitor

0

30 seconds

This task works under push mode. Check every agent state in table, if the CurrentTime - LastConnectTime > HeartbeatTime, then push the expired connection to queue for termination.

Fixed rate task

SEP11.x & SEP12.x