DB updates killing WAN bandwidth

[zebulebu]

Hi

 

Is there a way to run up a separate local repository of MEE? I have my server installed at our main colo, and it works well after some fine-tuning, but every time a pattern file is pulled, when it gets pushed out to my clients, it rinses my MPLS links to our two main offices as every client rushes to download at the time specified after the new pattern file is received. There is obviously an element of randomness - based on the time the client starts up - but this isn't very reliable, especially since the majority of clients in one of my offices start up at near enough the same time each day (it's a call centre)

 

If I could get a local repository at each site and point the clients local to that site there for DB updates it would mean I only had to push the pattern file once and clients could update locally - saving me a huge amount of bandwidth every day. If this isn't possible, then even being able to randomise the check-in interval for clients would be a help.

[Lazz]

Hi zebulebu,

 

Unfortunately a local repository is not possible within MEE at this time.  However, I have a solution hat will hopefully work for you.

 

What we want to do is to break up your clients into multiple policies (if they are not already) and have them communicate back to the server at different intervals.  This setting can be changed when editing a policy, under the Communication tab.  We are going to change the setting to "Check for policy update from server, every X minutes."

 

For example, we make policies A, B, and C.

 

For Policy A will have a time of 17 minutes.  Policy B will have 28 minutes.  Policy C will be 36 minutes. 

 

We basically want to pick times that are spaced apart and will not cross each other often, if at all.

 

Please let me know if this helps you out, or if you need any clarifications.

[zebulebu]

Hi Lazz

 

I have, in fact, already done this - but was looking for an elegant solution. Thanks anyway.

[Lazz]

We are always looking to make MEE better.  I will make sure the appropriate parties are aware of this.

 

Thank you!

[ajrechk]

We have this exact same issue and currently workaround this by having all of the machines pull their updates from the internet instead of the server housed in our datacenter.

 

Also, mbam's 'workaround' (which is not viable for an enterprise level product) does not resolve the issue at all after testing this out in our environment, as the update timer starts when the machine comes online.  If the timer setting was 17 minutes AFTER THE HOUR etc.. instead of just 17 minutes, then it may have a chance, however machines come online at different times throughout the day so the spacing means nothing and the WAN still gets killed.

 

Looking forward to a future update where distributed repositories are supported like in McAfee Epolicy Orchestrator.

 

 

[aengel]

I am having the same issue as well. WAN is being killed by updating which affects our EMR application severely. I've tried multiple policies with different timers but a lot of our computers get turned on at different times during the day.

 

I'm wondering if there are any updates regarding this issue?