Views:

When the OfficeScan client updates the pattern files, the following happens:

  1. The server.ini file is downloaded.
  2. The reserve file from \Program Files (x86)\Trend Micro\OfficeScan Client\Reserve is removed.
  3. The components that need to be updated are checked.
  4. The component updates are downloaded.
  5. Hot fix files are downloaded.
  6. The patch.exe file is executed.
  7. Updates are checked.
  8. Updates are implemented.
  9. Reserve file is recreated.

When this happens with the conventional scan method, the largest files that are updated daily account for about 200 MB of the file writes on a host.

The files (and approximate sizes) are:

FileDescriptionSize
C:\Program Files (x86)\Trend Micro\OfficeScan Client\lpt$vpn.835Newest pattern in its work location where OfficeScan is using it from.67575808
C:\Program Files (x86)\Trend Micro\OfficeScan Client\AU_Data\AU_Temp\1952_3964\3\4\lpt$vpn.833Pattern downloaded [22363] and merged by AU.67563520
C:\Program Files (x86)\Trend Micro\OfficeScan Client\ReserveReserved space which is deleted/reoccupied every time OfficeScan updates the pattern.62910464
C:\Program Files (x86)\Trend Micro\OfficeScan Client\AU_Data\AU_Log\TmuDump.txtLog for update procedure.383818
C:\Program Files (x86)\Trend Micro\OfficeScan Client\ssapi.logSSAPI log189939
C:\Program Files (x86)\Trend Micro\OfficeScan Client\AU_Data\AU_Temp\1952_3964\AU_Down\pattern\v_833.835The pattern update downloaded with AU.20480
C:\Program Files (x86)\Trend Micro\OfficeScan Client\AU_Data\AU_Temp\1952_3964\server.iniServer.ini file is downloaded at the beginning to know what to download and change.16384

This means that there is an approximately 200MB of files that have been changed.

If you use a snapshot backup method that cannot exclude files (such as ESX VMDK through NetApp), there are about 200MB of data backed up on each client every time you run the back up.