How are virus definitions distributed from the Symantec Endpoint Protection Manager?

book

Article ID: 180512

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

 

Resolution

The Symantec Endpoint Protection Manager (SEPM) can create delta definition packages for distributing just the changes made in the definitions since the last time a client was updated. This ability relies on the amount of content revisions maintained by the SEPM, which is configurable.


The SEPM checks for new definitions from a Symantec LiveUpdate Server by default every 4 hours.  Symantec typically releases 1 to 3 sets of Virus and Spyware definitions a day.  If the manager only maintains 3 content revisions of definitions, then a client that has been off for more than a single day will most likely require a full definition package which is usually around 120 MB in size. If the SEPM is configured to keep 10 content revisions of definitions, then a client can be off up to 3 days before the SEPM will need to send a full package to the client. If the client requests an update within that window, then it would be able to receive a delta package which would only contain the changes that occurred over the last 3 days and the size of which would be significantly smaller.


Sending only the changes between revisions to a hundred clients could significantly reduce network traffic versus sending out a full package of approximately 120 MB to a hundred clients.


By default, the amount of content revisions kept by the manager are configured by the amount of clients you initially specified when you installed the SEPM. Below are the default settings:

 

  • Less than 500 clients = 3 revisions - this takes approximately 8 GB of disk space on the server where the manager has been installed and is located on the drive where the manager has been installed.
  • 500-1000 clients = 15 revisions - this takes approximately 12 GB of disk space on the server where the manager has been installed and is located on the drive where the manager has been installed.
  • More than 1000 clients = 30 revisions - this takes approximately 24 GB of disk space on the server where the manager has been installed and is located on the drive where the manager has been installed.

As more definitions are sent out, these approximate sizes will change as the size of our definitions increase.


This behavior can be changed by logging into the SEPM and going to Admin > Local Site > Under Tasks select Edit Properties > Select the Liveupdate tab. This tab configures how the SEPM is set to update definitions. The settings here only apply for the SEPM and do not affect the clients. At bottom of the page is an option to select how many content revisions to keep. This can be increased or decreased according to your requirements. It is recommended to never reduce the amount of content revisions kept below 3.


If you reduced the amount of content revisions kept, the manager will delete the extra definitions from the database and from the folders where they are stored. If you increased the amount of content revisions kept, then over the next several days the amount of content revisions stored will increase to the desired level as definitions are released.


When a client checks in and requests new content, the manager builds the delta definition package that is required to update the definitions on that client to the latest definitions, and then sends it to the client.  If another client requires the same delta package, it does not need to build the package again.


If a Group Update Provider receives a delta definition package, it only needs to download it once to distribute it to the clients it serves.