The Symantec Endpoint Protection Manager Database is low or out of space
search cancel

The Symantec Endpoint Protection Manager Database is low or out of space

book

Article ID: 441472

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

The Symantec Endpoint Protection Manager (SEPM) database (DB) is full or running low on space.  This could be either the built-in SQL Express database used on default installs or a full SQL install.  Error or Warning messages regarding the size of the database may come either from the SEPM, SQL, or Operating System itself.  

Environment

  • Symantec Endpoint Protection Manager (SEPM)

Cause

Potential causes include.

  • SQL Express 2017 and 2022 have a 10GB database size limit.
  • One or more SQL FileGroups are full.
  • Drive or Disk partition storing database files is low on available space or full.
  • Amount of data being logged.
  • Log retention time.

Resolution

Since the root cause can have many different causes, not all steps below may be applicable.  If there are no obvious errors or warning messages logged by the SEPM that direct you to a specific FileGroup, Table, or file causing the issue, use these first set of steps to identify which table in the SEPM database is using the most space.

Checking Disk usage by Tables

Download and install SQL Server Management Studio to complete the steps in this section.  It will allow you to connect to the SQL Express instance hosting the SEPM database.

  1. Launch SQLSMS from the start menu.
  2. Connect to the SEPM database
    • Server Name: <Hostname>\<Instance Name> (default is <HOSTNAME>\SQLEXPRESSSYMC for SQL Express installs)
    • Authentication method will vary depending on install type. 
      • If it's a SQL Express install, try Windows Authentication while logged in as the OS Administrator that the SEPM was install as.
      • SQL Authentication can be tried.  DBA is the default SEPM database user.  The password was set during install.  If the password needs to be reset, follow the steps here.

Disk Usage Reports in SQL

There are two Disk Usage reports in SQL that can help identify which Table(s) are using the most space.

Disk Usage by Top Table

  1. In Object Explorer (left) expand the Hostname\Instance
  2. Expand Databases, right click on sem5 (default SEPM db name)
  3. Choose Reports -> Standard Reports -> Disk Usage by Top Tables

This will display Disk usage and statistics in descending order.  Click the Print button and print to pdf.  Provide this to support.

Disk Usage by Partition

  1. In Object Explorer (left) expand the Hostname\Instance
  2. Expand Databases, right click on sem5 (default SEPM db name)
  3. Choose Reports -> Standard Reports -> Disk Usage by Partition

This will display Disk usage and statistics in descending order.  Click the Print button and print to pdf. Provide this to support.

Disk Usage by FileName

  1. In Object Explorer (left) expand the Hostname\Instance
  2. Expand Databases,
  3. Right click on sem5 (default SEPM db name), choose New Query
  4. In the query field, paste in the below text and click Execute.
SELECT DB_NAME() AS [DatabaseName], type_desc AS [FileType], name AS [LogicalFileName], CONVERT(DECIMAL(12, 2), size / 128.0) AS [TotalAllocatedMB], CONVERT(DECIMAL(12, 2), FILEPROPERTY(name, 'SpaceUsed') / 128.0) AS [SpaceUsedMB], CONVERT(DECIMAL(12, 2), (size - FILEPROPERTY(name, 'SpaceUsed')) / 128.0) AS [RecoverableFreeSpaceMB] FROM sys.database_files WITH (NOLOCK) ORDER BY type, file_id;

Save the results by right clicking on the returned data and saving as .csv, the provide this to support.

 

Error or Warning logged in SEPM

An Unexpected Server Error is a common error message logged by the SEPM if one or more FileGroup (FG) is full and causes an issue with the SEPM.  In the scm-server-#.log you'll find more details about which FG is full.

Definitions stopped updating in SEPM

 

Changing the default database password

If you forget or don't know the default database (SQL Express) password it can be modified using the Management Server Configuration Wizard (MSCW).  Visit the TechDoc below and scroll to the bottom of the page where the section To change the default database password heading is and follow those steps.

https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/managing-groups-clients-and-administrators/managing-administrator-accounts-v17364367-d1e6/changing-the-password-for-an-administrator-account-v8542787-d1e1637.html

 

Ensure Database Maintenance Tasks are running

Two database maintenance tasks should be scheduled and running frequently.

  • Truncate the database transaction logs (default: Every 4 hours)
  • Rebuild Indexes (default: Weekly)

These two maintenance tasks help the SEPM database perform optimally and should remain enabled.  These settings can be controlled from within the SEPM on the Admin -> Servers -> Local Site -> Database -> Tasks -> Edit Database Properties, General tab.  These tasks may also be scheduled directly in SQL.  If these two tasks are scheduled within SQL, it is not required to enable the tasks within the SEPM database properties.

 

Powered by Wolken Software