search cancel

Low disk space on a Symantec Endpoint Protection Manager

book

Article ID: 161664

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

The operating system indicates that there is low disk space on a system running Symantec Endpoint Protection Manager. The system has poor performance.

Resolution

Note: To check if this issue exists or has been resolved on the computer in question, download and run SymHelp.

Low disk space is a common problem with a wide variety of possible causes.  Running low on disk space is both an issue and a cause of multiple potential issues.  Unless the operating system or some other program provides an alert, it may not be recognized that low disk space is influencing the unwanted behavior that is observed.

To determine if data created by the Symantec Endpoint Protection Manager (SEPM) is using an unusually large amount of disk space review the list of data points (files or folders) below and what steps are recommended should those data points be determine to be of an excessive size.

Excessive size is indicated by checking the file or directory resource against the given threshold.  The threshold is based on a reading of telemetry from previous runs of SymHelp across customer environments.  The threshold is set to that value for the file or directory size which is exceeded by only the top %5 of customer systems.  If your system exceeds this threshold, then it is recommended that you take troubleshooting steps outline in the action section for that file or directory.

The threshold is a value that is somewhat arbitrary although it is set based on measurement of deployed customer systems.  It is meant only to provide some basis for determining whether it may be useful to treat the file or directory size as a potential product technical issue, but is not diagnostic of a definite product issue.

SEM5 LOG

Log Name

sem5.log

Default Location

C:\Program Files(x86)\Symantec\Symantec Endpoint Protection Manager\db

Threshold (February 2015*)

10GB

Actions

  • TECH178718: An issue with the sem5.log file growing indefinitely for the SEPM's embedded database was identified and resolved in version 12.1 RU1 MP1.
  • HOWTO109605: Verify that the default SEPM configuration to truncate the database is in effect
  • TECH171546: Perform a manual truncation
  • TECH217436: Replace a corrupt log

* In the current release of SymHelp (v2.1.72) the threshold has not yet been set based on telemetry data.

TOMCAT LOGS

Default Location

C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\logs

Threshold (August 2015)

9104 or more files

Actions

  • TECH230072: Create drive space by reducing log configuration to default values.