Content revision best practices for Endpoint Protection Manager

Products

• Endpoint Protection

Issue/Introduction

Learn the best practices for setting the number of content revisions to keep in the Symantec Endpoint Protection Manager (SEPM).

Resolution

The management server downloads full content only once, at install time. Thereafter, deltas are downloaded, and the latest full content is reconstructed from the reference content version plus forward deltas. If earlier full versions are needed, they are reconstructed from the full content version plus backward deltas.

To determine how many content revisions you should keep consider the following:

• For the majority of your clients how often do they communicate with their Symantec Endpoint Protection Manager?
• Historically, how long have your clients had to go without communication with their Symantec Endpoint Protection Manager?
• What disaster recovery scenarios must you consider and of what duration?

The number of content revisions to keep should depend on the need to balance network bandwidth usage with the amount of hard drive storage availability on the SEPM. This setting should be made with the specific network environment's requirements and limitations in mind.

Technical details

To determine how long it will take to perform a content distribution update in a best case scenario, use the following formula of:

Concurrent Connections x Content Size* ÷ Available Bandwidth (in KBps) = Content Distribution Time (in seconds)

* Average Content Size = 200 Kb

The following table assumes that the entire network is dedicated to the update -- that is, all available bandwidth is consumed by the content download, and all clients download content concurrently. A real world scenario would be more complex.

Example of Content Distribution Time with a 200kB update

Bandwidth	Number of clients	Time
T1 (1.54Mbps, or 192.5 KBps)	5,000 15,000	90 minutes 4.5 hours
10 Mbps (1250 KBps)	5,000 15,000	14 minutes 40 minutes
100 Mbps (12,500 KBps)	5,000 15,000	80 seconds 4 minutes
1 Gbps (125,000 KBps)	5,000 15,000	8 seconds 24 seconds

Note: Latency can also be affected by network utilization and protocol overhead.

Content storage

• You can configure the number of content revisions to store at Admin > Servers > Local Site > Edit Site Properties > LiveUpdate tab > Disk Space Management for Downloads. See Manage disk space on Endpoint Protection Manager.
• All deltas from full definitions are kept on the SEPM.
• Clients that are more than three (3) months out of date may result in the SEPM attempting to store deltas larger than 100MB. These large delta files may cause unpredictable behavior or cause issues, for example, with replication.