How to determine what content Symantec Endpoint Protection (SEP) 12.1 clients are downloading from a Group Update Provider (GUP)?
Find events regarding updates from the GUP by logging in to the Symantec Endpoint Protection manager (SEPM) console:
Monitors > Logs > Log type: System > Log content: Client activity > View log:
As shown in the screenshot, filter the report by selecting the appropriate event type (Client events) and Event source (SYLINK).
Saving the filtered report will allow using it again without recreating it every time.
Click on Export at the top of the screen to get the results as a CSV file, for editing in Excel for example, to create a document to match administrative requirements.
Symantec Endpoint Protection 12.1