Symantec Endpoint Protection Content Distribution Monitor tool

- Symantec Endpoint Protection Content Distribution Monitor tool

- Using the Content Distribution Monitor tool

- Legal notice

## Symantec Endpoint Protection Content Distribution Monitor tool

^Back to top

What is the Content Distribution Monitor tool?

The Content Distribution Monitor tool is a standalone tool that helps you monitor management servers, clients, and Group Update Providers (GUPs) in your environment. The tool runs directly on the Symantec Endpoint Protection Manager and shows a graphical display of the health and content distribution status, site throughput, and the Symantec Endpoint Protection Manager database table records.

The tool provides data for Windows clients only, and not for Mac clients or Linux clients.

Installing and configuring the Content Distribution Monitor tool

To install and configure the tool, you must:

1. Install and launch the Content Distribution Monitor tool.

   Step 1: Installing the Content Distribution Monitor tool

2. Point to the paths to the Apache logs for every management server you want to monitor.

   Step 2: Adding the Apache log paths for the management servers you want to monitor

3. Enable the Apache logs on the management servers you want to monitor.

   Step 3: Enabling the Apache log on each management server

Troubleshooting the Content Distribution Monitor

See Using the Content Distribution Monitor tool.

Step 1: Installing the Content Distribution Monitor tool

You can run the Content Distribution Monitor tool with Symantec Endpoint Protection Manager directly or remotely.

To install the Content Distribution Monitor tool

1. From the installation file that you download from MySymantec, copy the `Tools/ContentDistributionMonitor`/`ContentDistributionMonitor.bat` file to the default `C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\Tools` folder.

   In 12.1.6.x and earlier, this file is named `SepmMonitor.bat`.

2. Double-click the .bat file that you copied, and at the command prompt, press any key.

   It may take a few seconds for the tool to launch.

Step 2: Adding the Apache log paths for the management servers you want to monitor

You must add the path to the Apache log for each management server so that the Content Distribution Monitor can obtain the package size of the virus definitions. That data is used in the Virus/Spyware content downloads today from SEPM(s) table.

To add the Apache log paths for the management servers you want to monitor

1. In the Symantec Content Distribution Monitor, click the Configure link in the upper right-hand corner of the tool
2. In the Apache log path text field, add the location of the Apache log for each management server you monitor, and click OK.

   For example:

   C:\Program Files\Symantec\Symantec Endpoint Protection Manager\apache\logs

   All the folder paths should be accessible to the computer from where you run the Content Distribution Monitor. Separate each path with a semi-colon.

Step 3: Enabling the Apache log on each management server

The Symantec Endpoint Protection clients communicate with the management servers through the Symantec Endpoint Protection Manager Apache web server using either the HTTP protocol or the HTTPS protocol. You must enable and define error logging on each management server that the tool monitors.

Note: | If you do not regularly remove the older logs, the hard drive may fill up quickly. To remove older logs and reduce the amount of data, either write a script or remove the logs manually on each management server. Apache doesn't purge the old log entries automatically.

To enable the Apache log on each management server

1. Locate and make a backup of one of the following files:

   - For the HTTP protocol: `C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\conf\httpd.conf`

   - For the HTTPS protocol: `C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\conf\sslForClients.conf`

2. Change the error log file name format and log rotation to 24 hours:

   - For HTTP, in the `httpd.conf` file, change:

     ErrorLog "|| bin/rotatelogs.exe -n 2 logs/error.log 100M"

     To:

     ErrorLog "|| bin/rotatelogs.exe logs/error-%Y-%m-%d.log 86400"

   - For HTTPS, in the `sslForClients.conf` file, change:

     ErrorLog "|| bin/rotatelogs.exe -n 2 logs/ssl_errors.log 100M

     To:

     ErrorLog "|| bin/rotatelogs.exe logs/error-%Y-%m-%d.log 86400"

3. The log is enabled by default; if it is not, remove the # in front of ErrorLog.
4. Change the custom log file name and log rotation to 24 hours:

   For version 14.x:

   - For HTTP, in the `httpd.conf` file, change:

     CustomLog "|| bin/rotatelogs.exe -n 2 logs/access.log 100M" common

     To:

     CustomLog "|| bin/rotatelogs.exe logs/access-%Y-%m-%d.log 86400" SEPM

   - For HTTPS, in the `sslForClients.conf` file, change:

     CustomLog "|| bin/rotatelogs.exe -n 2 logs/ssl_access.log 100M" ssl_common

     To:

     CustomLog "|| bin/rotatelogs.exe logs/access-%Y-%m-%d.log 86400" SEPM

   For version 12.1.x:

   - For HTTP, in the `httpd.conf` file, change:

     CustomLog "|| bin/rotatelogs.exe -n 2 logs/access.log 100M" common

     To:

     CustomLog "|| bin/rotatelogs.exe logs/access-%Y-%m-%d.log 86400" common

   - For HTTPS, in the `sslForClients.conf` file, change:

     CustomLog "|| bin/rotatelogs.exe -n 2 logs/ssl_access.log 100M" ssl_common

     To:

     CustomLog "|| bin/rotatelogs.exe logs/access-%Y-%m-%d.log 86400" common

5. The log is enabled by default; if it is not, remove the # in front of CustomLog.
6. Change LogLevel warn to LogLevel info.
7. Save and then close the file.
8. Restart the Apache web server by opening a command prompt and typing `net stop semwebsrv` and `net start semsrv`.

Troubleshooting the Content Distribution Monitor

You can find the debugging log for the Content Distribution Monitor tool at: `C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\logs\ContentDistributionMonitor.log`. This log contains all the log data that is related to the tool.

To get help from other customers or to provide comments and suggestions, see:

http://entced.symantec.com/sep/14/sepcdm_forum

## Using the Content Distribution Monitor tool

^Back to top

For more information on the tables in the tool, see:

- Content Distribution tab

- Site Information tab

- Database tab

Changing the configuration settings

You use the Configuration dialog box to configure the Content Distribution tab settings and the auto-fresh setting for all tabs.

To change the configuration settings

1. In the Content Distribution Monitor tool, click the Configure link in the upper right-hand corner of the tool.
2. Modify any of the following settings, and then click OK.

Table: Configuration dialog box

Option | Description
--- | ---
Auto-refresh | Specifies how often a table is refreshed, in minutes.
Content thresholds | Indicates the color convention that is used in the Distribution Summary table. If the corresponding count falls below the percentage you specify, the text appears in red. The values above the percentage appear in green.
Low disk space limit | Identifies the computers with the free disk space that is less than the configured setting. It is used for the Potential content load issues and Operational status of GUPs tables.
Low memory limit | Identifies the computers with the free memory that is less than the configured setting. It is used for the Operational status of all GUPs table.
Out-of-date client view | Specifies whether to display values for clients by which network they are in or by their client group. This setting affects the display in the following tables: Virus/Spyware online and out-of-date Network/Client Group IPS online and out-of-date by Network/Client Group
Show GUPs | Specifies whether to display all GUPs or the abnormal GUPs only in the Operational status of all GUPS/abnormal GUPs table.
Apache log path | Specifies the location of the Apache log for each management server you monitor. For example: C:\Program Files\Symantec\Symantec Endpoint Protection Manager\apache\logs You must add the path to the Apache log so that the Content Distribution Monitor can obtain the package size of the virus and spyware content. That data is used in the Virus/Spyware content downloads today from SEPM(s) table. All the folder paths should be accessible to the computer from where you run the Content Distribution Monitor. Separate each path with a semi-colon. You must enable the Apache logs on the management servers that the tool monitors. Step 3: Enabling the Apache log on each management server

Content Distribution tab

This tab displays any issues that the management servers and GUPs might have with content distribution on the clients. To export the data from each table to a .csv file, click the export icon(s).

Table: Content Distribution tab

Table | Description
--- | ---
Latest versions available | Displays the revision number for virus and spyware, IPS, and SONAR content. The Symantec column shows the revision number that is available on the Symantec LiveUpdate server to download to the management server. The SEPM column shows the revision number that is available to download to the clients. You can also click the icons to run LiveUpdate and access the rapid release contents folder.
Virus/Spyware content downloads today from SEPM(s) | Displays the number and size of the virus and spyware content packages that are available to download from the management servers. For data to appear in this table, you must: Add the Apache log path in the Configuration dialog box. Changing the configuration settings Enable the Apache log; make sure that you change LogLevel warn to LogLevel info. Changing the log level can cause the hard drive to fill up with many logs, so make sure you continually remove old logs. Step 3: Enabling the Apache log on each management server The data is based on the content that is downloaded from 12:00 A.M. (GMT) to the current time.
Distribution Summary | Displays the number of management servers, GUPs, and online clients that have the latest virus and spyware and IPS content. Online clients are the clients that are managed and connected to the management server.
Virus/Spyware online and out-of-date by Network/Client Group | Displays the number of online Windows clients that do not have latest virus and spyware content. To toggle the display between all clients in the network and clients in a group, click the folder icon. You can also change the setting in the Configuration dialog box > Out-of-date client view option.
IPS online and out-of-date by Network/Client Group | Displays the number of online Windows clients that do not have latest IPS definitions. To toggle the display between all clients in the network or clients in a group, click the folder icon. You can also change the setting in the Configuration dialog box > Out-of-date client view option.
Potential content load issues | Displays the total number of clients that have low disk space, corrupted content, or missing content. You can configure the amount of disk space in the Configuration dialog box > Low disk space threshold option.
Operational status of all GUPs/abnormal GUPs | Displays the information about each GUP, such as the online status, the host name, IP address, and group. You can toggle the display between all the GUPs or only abnormal GUPs. A GUP is considered to be abnormal if any one of the following conditions are met: Offline Not having latest virus and spyware content Not having latest IPS content Less disk space than the configured setting Less memory than the configured setting

Site Information tab

This tab displays the throughput data that is collected after the last heartbeat between this site's management servers and the client computers. These data reflect the status between the management servers and clients for the current site. During each heartbeat, the management server updates the logs and the security policy, and checks the communication status between the client and the server.

The throughput values are recorded on a per-second basis in the last 60 seconds only. You typically see zero values only. You see non-zero values only when you have many clients and there is a lot of traffic between the management server and the clients. For example, to display a non-zero value for Client System Logs received per second, the clients must generate over 60 client System log entries per minute in the last 60 seconds.

The values are refreshed based on the Auto-refresh interval in the Configuration dialog box.

Changing the configuration settings

Table: Site Information tab

Table | Description
--- | ---
Throughput details on last heartbeat for each server | Server Name The management servers that are associated with each site. Heartbeat The frequency with which clients and the management server communicate to update logs and download policies, in seconds. Displays the average throughput from the last heartbeat for all the management servers in a site, in seconds. The default heartbeat interval is 5 minutes. Policies Downloaded The number of policies that the clients downloaded. Intrusion prevention Download The number of IPS signatures that the clients downloaded. Learned Applications The number of learned applications that the clients send to the management server. This value is calculated only for clients for which you enable the Learn applications that run on the client computers option. You enable this option in Symantec Endpoint Protection Manager by clicking Clients > Policies > Communications Settings. Client Logs Received The number of updates by clients.
Site throughput sampling from last heartbeat | Total installed clients The number of clients that each management server in each site manages. The clients may or may not currently communicate with the management server. This number does not include unmanaged clients. Total online clients The number of clients that are currently online and that communicate with the management server. Policies downloaded per second The number of policies that the client downloads from the management server on a per-second basis. This value is always a zero unless the number of policies that are downloaded on all the clients in the last minute exceeds 60. For example, if all the clients downloaded 120 policies in the last 60 seconds, this value is a 2. Intrusion prevention signatures downloaded per second The number of IPS signatures that the management server downloads to all clients on a per-second basis. Learned applications per second The number of learned applications that the clients send to the management server on a per-second basis. This value is calculated only for clients on which Learned Application setting is enabled. <log name> logs per second The number of log entries for each type of Enforcer log. You must have Network Access Control installed to see any values. Client information updates per second The number of updates by all clients. <log name> logs received per second The number of log entries that are sent from the clients to the management server.

Database tab

This tab displays the data from the Symantec Endpoint Protection Manager database tables, also called the database schema. The accuracy of the data depends on the replication frequency.

Table: Database tab

Table | Description
--- | ---
Database Tables | The name of each Symantec Endpoint Protection Manager database table and the number of records in each table. If you have more records than you expect, the database may not be purging the older records properly.
Replication Info | The oldest replication time across all sites. The oldest database data is purged first.
Status | Each interaction that the Content Distribution Monitor tool has with Symantec Endpoint Protection Manager.

## Legal notice

^Back to top

Product version: 14.x

Documentation version: 3

This document was last updated on: January 17, 2020

Broadcom, the pulse logo, Connecting everything, and Symantec are among the trademarks of Broadcom.

Copyright © 2020 Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.

For more information, please visit https://www.broadcom.com.