When the OfficeScan client updates the pattern files, the following happens:
- The server.ini file is downloaded.
- The reserve file from \Program Files (x86)\Trend Micro\OfficeScan Client\Reserve is removed.
- The components that need to be updated are checked.
- The component updates are downloaded.
- Hot fix files are downloaded.
- The patch.exe file is executed.
- Updates are checked.
- Updates are implemented.
- Reserve file is recreated.
When this happens with the conventional scan method, the largest files that are updated daily account for about 200 MB of the file writes on a host.
The files (and approximate sizes) are:
| File | Description | Size |
|---|---|---|
| C:\Program Files (x86)\Trend Micro\OfficeScan Client\lpt$vpn.835 | Newest pattern in its work location where OfficeScan is using it from. | 67575808 |
| C:\Program Files (x86)\Trend Micro\OfficeScan Client\AU_Data\AU_Temp\1952_3964\3\4\lpt$vpn.833 | Pattern downloaded [22363] and merged by AU. | 67563520 |
| C:\Program Files (x86)\Trend Micro\OfficeScan Client\Reserve | Reserved space which is deleted/reoccupied every time OfficeScan updates the pattern. | 62910464 |
| C:\Program Files (x86)\Trend Micro\OfficeScan Client\AU_Data\AU_Log\TmuDump.txt | Log for update procedure. | 383818 |
| C:\Program Files (x86)\Trend Micro\OfficeScan Client\ssapi.log | SSAPI log | 189939 |
| C:\Program Files (x86)\Trend Micro\OfficeScan Client\AU_Data\AU_Temp\1952_3964\AU_Down\pattern\v_833.835 | The pattern update downloaded with AU. | 20480 |
| C:\Program Files (x86)\Trend Micro\OfficeScan Client\AU_Data\AU_Temp\1952_3964\server.ini | Server.ini file is downloaded at the beginning to know what to download and change. | 16384 |
This means that there is an approximately 200MB of files that have been changed.
If you use a snapshot backup method that cannot exclude files (such as ESX VMDK through NetApp), there are about 200MB of data backed up on each client every time you run the back up.