search cancel

After I upgrade my SEPM, I see many "Network Load: Requests for Full Definitions" notifications

book

Article ID: 162437

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

After you upgrade your Symantec Endpoint Protection Manager (SEPM), to version 12.1 RU6 or later, you start receiving a large number of "CRITICAL: NETWORK LOAD ALERT: Too many requests for full definitions" alerts from the SEPM via email.

Cause

Symantec Endpoint Protection Manager 12.1 RU6 and later have enabled the "Network Load: Requests for Full Definitions" alert by default. This alert is designed to notify administrators of possible impending bandwidth problems, as clients request and download full definition updates.

The default threshold for this alert is 25 requests for full definition sets, for any definition types, within 10 minutes.

Resolution

Definition sets that are small, or which are not updated frequently, may tend to be distributed in full definition sets, rather than as delta sets.

Because all requests for full definition sets are tracked, regardless of the type of content requested, clients that are requesting multiple types of content updates may cause the counter to artificially inflate to the point of sending an alert.

It is possible for just a few client computers to trigger an alert, if they request multiple content types.

Review the information in the alert to see which content types are being downloaded and the size of those downloads.

If you see a number of these alerts, you may need to adjust the threshold for the notification to a level that it appropriate for the number of client computers that you have deployed.

To adjust the notification threshold:

  1. Log in to your SEPM and, in the left pane, click Monitors.
  2. In the right pane, on the Notifications tab, click Notification conditions.
  3. In the resulting list of notification conditions, click Network Load: Requests for Full Definitions, and then click Edit.
  4. In the Edit Notification Condition dialog box, next to Notification condition, adjust the number in the requests for full definitions text box to a more suitable threshold for your environment.
  5. Click OK.

Your SEPM will now send alerts only when the new threshold is reached.