cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
AZ
Level 7
Report Inappropriate Content
Message 1 of 6

Application Control client disk overflow when down from ePO server

Jump to solution

Hello,

We had a disk overflow issue when the Application Control client was temporary down from the ePO server.

Is there a configuration way to limit the client/agent's disk consumption, more specificly, overwrite logs when a max disk size is reached?

Thank you

 

Labels (1)
1 Solution

Accepted Solutions
McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: Application Control client disk overflow when down from ePO server

Jump to solution

Can you explain if it was client or server. Your explaination is not clear.

 

Logs should rollover a 2MBs and keep 5 revisions. You can change this setting "sadmin config show" ..

 

How to control the s3diag and Solidcore log file size and numbers of files generated in logs directory
Technical Articles ID:   KB79200
Last Modified:  12/13/2017

Environment

McAfee Application and Change Control (MACC) 8.x, 7.x, 6.x
 
 

Solution

With MACC, you can control the s3diag and solidcore log file size and logfile numbers (in the solidcore log directory).

To change the number of log files, type the following command and press ENTER:
 
sadmin config set LogFileNum=n*

(where n* is the number of files in decimal)


To change the size of log files, type the following command and press ENTER:
 
sadmin config set LogFileSize=nnnn**

(where nnnn** is the size of the file in kilobytes (KB))

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

5 Replies
McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: Application Control client disk overflow when down from ePO server

Jump to solution

Can you explain if it was client or server. Your explaination is not clear.

 

Logs should rollover a 2MBs and keep 5 revisions. You can change this setting "sadmin config show" ..

 

How to control the s3diag and Solidcore log file size and numbers of files generated in logs directory
Technical Articles ID:   KB79200
Last Modified:  12/13/2017

Environment

McAfee Application and Change Control (MACC) 8.x, 7.x, 6.x
 
 

Solution

With MACC, you can control the s3diag and solidcore log file size and logfile numbers (in the solidcore log directory).

To change the number of log files, type the following command and press ENTER:
 
sadmin config set LogFileNum=n*

(where n* is the number of files in decimal)


To change the size of log files, type the following command and press ENTER:
 
sadmin config set LogFileSize=nnnn**

(where nnnn** is the size of the file in kilobytes (KB))

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

AZ
Level 7
Report Inappropriate Content
Message 3 of 6

Re: Application Control client disk overflow when down from ePO server

Jump to solution

Thank you for your reply.

This disk overflow issue happened on the client side. Actually, we found out that it was not the log files but the agent event xml files under the client's \agent\agentevent folder that filled up the disk since the client was disconnected from the server for some reason.

The question now is that "Does McAfee application control ePO mode have a way to control/limit the agent/client event xml files stored on the client side in case the client is disconnected from the server to avoid overflowing the client disk?"

McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: Application Control client disk overflow when down from ePO server

Jump to solution

No we do not have a way to controll the xml files to epo .. if the agent is disconnected. If you see it you can unmanage the client but i dont recommend that cause soon as you reconnect ma then you would have to remanage.

 

My recommendation is to setup alerts for machines that dont communicate to epo over certain amount of hours. You may need to prioritze with tags so you dont get bombarded with machines from users that are not important.. 

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

AZ
Level 7
Report Inappropriate Content
Message 5 of 6

Re: Application Control client disk overflow when down from ePO server

Jump to solution

In the situation we had, the ePO client/agent filled up the hard disk with event XML files at the rate of 47.5GB per day when the connect to ePO server was lost temporarily. It seems that the ePO client/agent is not fail-safe.

Is there a way to make the ePO client/agent fail-safe?

 

McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: Application Control client disk overflow when down from ePO server

Jump to solution

Sounds like you need to fine tune some products. 

 

but that would really be a question for EPO or MA for a failsafe for that much data.

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • Visit: Business Service Portal
  • More: Search Knowledge Articles
  • ePolicy Orchestrator Support
  • The McAfee ePO Support Center Plug-in is now available in the Software Manager. Follow the instructions in the Product Guide for more.