3 Replies Latest reply on Apr 14, 2010 9:50 PM by ntkn123

    Incremental def

      Hi ,

      I  have 14 branches across the city and every branch has 15-25 systems .

       

      All the branches are connected to my head office using 64 kbps link .Is this possible for remote site pulling update from my epo server.

       

      q1) What is the size of every day def size

      q2) Every week all desktop pc switched off on saturday and sunday - how much size wil be downloaded on monday

      q) Is there is any bandwidth saving using super agent

       

       

      Thanks for your help

        • 1. Re: Incremental def

          Each day varies in the size of the update depending on what virus definitions are added etc. On average though, they are between 50 and 150kb in size.

           

          Here's the last 30 days worth including size:



          [   ] 59165917avv.gem         14-Apr-2010 12:14  158K 
          [   ] 59175918avv.gem         14-Apr-2010 12:14   83K 
          [   ] 59185919avv.gem         14-Apr-2010 12:14  234K 
          [   ] 59195920avv.gem         14-Apr-2010 12:14   39K 
          [   ] 59205921avv.gem         14-Apr-2010 12:14   27K 
          [   ] 59215922avv.gem         14-Apr-2010 12:14   37K 
          [   ] 59225923avv.gem         14-Apr-2010 12:14   79K 
          [   ] 59235924avv.gem         14-Apr-2010 12:14  135K 
          [   ] 59245925avv.gem         14-Apr-2010 12:14  134K 
          [   ] 59255926avv.gem         14-Apr-2010 12:14  143K 
          [   ] 59265927avv.gem         14-Apr-2010 12:14  235K 
          [   ] 59275928avv.gem         14-Apr-2010 12:14  104K 
          [   ] 59285929avv.gem         14-Apr-2010 12:14  121K 
          [   ] 59295930avv.gem         14-Apr-2010 12:14   97K 
          [   ] 59305931avv.gem         14-Apr-2010 12:14  172K 
          [   ] 59315932avv.gem         14-Apr-2010 12:14  251K 
          [   ] 59325933avv.gem         14-Apr-2010 12:14  209K 
          [   ] 59335934avv.gem         14-Apr-2010 12:14  165K 
          [   ] 59345935avv.gem         14-Apr-2010 12:14  103K 
          [   ] 59355936avv.gem         14-Apr-2010 12:14  110K 
          [   ] 59365937avv.gem         14-Apr-2010 12:14  159K 
          [   ] 59375938avv.gem         14-Apr-2010 12:14  158K 
          [   ] 59385939avv.gem         14-Apr-2010 12:14  170K 
          [   ] 59395940avv.gem         14-Apr-2010 12:14  165K 
          [   ] 59405941avv.gem         14-Apr-2010 12:14  172K 
          [   ] 59415942avv.gem         14-Apr-2010 12:14  163K 
          [   ] 59425943avv.gem         14-Apr-2010 12:14  211K 
          [   ] 59435944avv.gem         14-Apr-2010 12:14  142K 
          [   ] 59445945avv.gem         14-Apr-2010 12:14  172K 
          [   ] 59455946avv.gem         14-Apr-2010 12:14   67K 
          [   ] 59465947avv.gem         14-Apr-2010 12:14   34K 
          [   ] 59475948avv.gem         14-Apr-2010 12:14  225K 
          [   ] 59485949avv.gem         14-Apr-2010 12:14  154K 
          [   ] 59495950avv.gem         14-Apr-2010 12:14  113K 
          [   ] 59505951avv.gem         14-Apr-2010 12:14  256K 

          Note that if a full zip file update is required
          (ie the computer is more than 30 days out of date),
          that is currently ~62Mb.

          A Super Agent is probably a good idea, as that
          (if configured correctly) will let the local pc's
          update from that instead of calling back to the EPO
          server. The caveat is that to replicate the repository
          to that site does take up a lot of bandwidth
          (could be up to 100Mb of changes in a day), but you can
          schedule that for low-utilisation periods.

           

           


           

           

          Message was edited by: Mal09 on 14/04/10 21:37:47 GMT
          • 2. Re: Incremental def

            Hi ,

             

            Thanks for your response. Please clarify me on the following points:

             

            With the help of Super Agent I will have update happens at three levels :

             

            1) EPO Gets Update from McAfee Secure Website : This is typcially full size , it can be around 64 MB /DAY (if I am doing every day once)

            2) Super Agent gets update from EPO  : Is this full or incremental . what is the average downlaod size ?

                        If it is going to be full size ,then I will be benefited on bandwidth for a remote site which has more than 470 systems ( assuming average every client  downlaod 150 kb per day from epo)

            3) Endpoint gets update from Super Agent : Is this incremental , 150 kb/day (appx)

             

             

            Thanks

            • 3. Re: Incremental def

              ntkn123 wrote:

               

              Hi ,

               

              Thanks for your response. Please clarify me on the following points:

               

              With the help of Super Agent I will have update happens at three levels :

               

              1) EPO Gets Update from McAfee Secure Website : This is typcially full size , it can be around 64 MB /DAY (if I am doing every day once)

              2) Super Agent gets update from EPO  : Is this full or incremental . what is the average downlaod size ?

                          If it is going to be full size ,then I will be benefited on bandwidth for a remote site which has more than 470 systems ( assuming average every client  downlaod 150 kb per day from epo)

              3) Endpoint gets update from Super Agent : Is this incremental , 150 kb/day (appx)

               

               

               

              Here's basically what will occur:

               

              EPO will pull the dats from the McAfee Website (this is normally incremental updates unless you specify a full download) and store them in the Master Repository. By Incremental it means changed files, not deltas of changed files.

               

              As indicated earlier, I would expect this to be up to 100Mb or possibly higher (The biggest change each day is the .zip file containing the full dat file - it's currently 61Mb, and when using the regular dat update site, this file is in two places in the directory structure - The root, and also /current/vscandat1000/dat/0000/ . There is a another repository site that doesn't contain these files in the root, so the size of the daily update won't be as large. This can be used if your environment only has particular products like VirusScan that don't rely on the updates being hosted in the root of the update site.

               

              Sample sites:

              http://update.nai.com/products/commonupdater/

              http://update.nai.com/products/commonupdater2/ (No files in the root)

               

              I can't give an exact figure for the size of daily changes.

               

              If you then have a SuperAgent (with Repository) on your Lan at the remote site, then it will also incrementally (unless specified otherwise) update. So the same Mb of changes will be replicated to that site.

               

              And if the correct settings are applied in EPO For where the clients should update from, then they will use the SuperAgent Repository rather than calling back home to the EPO server. So assuming ~450 clients at the end site, then it will be reasonably bandwidth neutral with the two options. However, if you have some computers that are > 30 days out of date, or have to roll out a new Engine, then it quickly become bandwidth saving. As an example, a freshly imaged PC is plugged into the network and needs to update. That's ~62Mb being pulled back from EPO vs being pulled back from the local site. 450 computers updating to a new engine is ~2000Mb (~4Mb each). So again a huge saving on bandwidth if the updates are local rather than coming from EPO.

               

              There's a bit more info in the EPO 4.5 Product guide https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/ 21000/PD21812/en_US/epo_450_product_guide_en-us.pdf if you want to read up a bit more about SuperAgent Repositories and how they work.