About the ESM manager

Symantec ESM managers do the following:

Control and store policy data, and pass the data to agents or ESM console as needed.
Gather and store security data from agents
Pass the data to ESM console.

The manager uses the control information files (CIF) server to communicate with agents and ESM console. Several data files that the CIF server accesses are stored in a proprietary format on the manager workstation or server.

The control information files (CIF) server is the primary component of the manager and an important part of the Symantec ESM information exchange process.

The manager stores the following data:

Manager access
Domains
Agents
Policies
Policy runs
Templates
Suppressions
Messages that the security modules in the CIF server generate

The CIF server provides access to the CIF files. When the ESM console or commandline interface (CLI) needs information from the CIF files, it communicates with the CIF server. The CIF server accesses the CIF files and relays the information back to the ESM console or CLI.

The CIF server also relays requests to other components of the manager. For example, when a client such as the ESM console or CLI sends a request for a policy run, the CIF server starts the job starter and tells it to start a policy run.

The ESM console or CLI establishes communications with the CIF server by logging on with the manager name, manager account name, password, and protocol. The net server is another component of the manager. It provides CIF server, local file, and agent server access to remote clients.

The net server uses the Symantec ESM client server protocol (CSP) to provide communication between processes on different computers.

While the manager component is initially small and the CIF servers remain small, raw reports can consume at least 2 MB per agent.