(I apologize is this is int he wrong section, I could not easily find the one it should be in)
We have 2 SEPM servers:
That watch just over 17,000 Endpoints:
Right now we are experiencing some issues with the size of the definitions that are stored. According to http://www.symantec.com/business/support/index?page=content&id=TECH96214 if you have more than 1,000 endpoints you should keep around 30 revisions. So we do:
Now we are experience some issues with size the size of the definitions. On the main server we had an 80 gig drive, one day while looking into some issues we found that it was maxed out, so we increased it by 20 gigs. Instantly it was filled. We continued to do so until it was 120 gigs, and even now it is maxed.
Now this is rather troubling, from what I've looked at I can't see why it is so large nor where it will max out. We of course want it large enough to hold everything, but what's that size?
Another troubling problem is that on our other server (AV7) we also increased the size to 120 gig, and yet it hasn't gone above the 72 gigs it started with.
I have read through http://www.symantec.com/business/support/index?page=content&id=TECH92225, but did not find any help on the size we should have.
SebastianZ a Symantec Employee pointed out here http://www.symantec.com/connect/forums/sepm-content-folder-size that
As you are keeping 20 revisions - 1.3/1.4GB x 20 = the content folders for the AV defs only may increase in size up to 26 GB / 28 GB and this is expected.
So thinking we have 30 revisions x 1.4GB = 42GB. Even if we say the size of each is 3.5gig X 30 = 105GB.
So my questions
1 - What is the sweet spot for the 30 revisions we are storing and why?
2 - Why is the revision amount different on these two servers, yet they are both set up the same?
Let me know if any more information is needed!