cancel
Showing results for 
Search instead for 
Did you mean: 
DavHio
Level 9

Failed deleting DLP events from database

According to the Database Statistics in the DLP console we have abit over 34 milion events. I used Delete Events by Number of Days and Delete Events by Date and both options eventually fails with the error message. When looking again, after refreshing the Database Statistic view, the events increased slightly instead of decreasing.

Error message: Failed performing Database administration task. The requedt channe timed out...."

Any ideas?

Thanks

0 Kudos
10 Replies
SafeBoot
Level 21

Re: Failed deleting DLP events from database

I don't know this product well, but my gut feeling is to try to delete less events at a time?

0 Kudos
DavHio
Level 9

Re: Failed deleting DLP events from database

Thanks for the reply

I tried to do that too, both by number of days and date. No success

/David

0 Kudos
vimalnavis
Level 13

Re: Failed deleting DLP events from database

What version of DLPe are you using? Does the account you used to log in to the machine have full permission in SQL?

0 Kudos
DavHio
Level 9

Re: Failed deleting DLP events from database

Hello vimalnavis

We are using DLP 9.2 and the account have full permissions to the SQL.

0 Kudos
mgg
Level 7

Re: Failed deleting DLP events from database

You might want to consider formally raising a case with McAfee. I believe there is an issue with the DB structure that casues the issue - DLP events related indexing.. well lack of it..

May need to access the DB directly to remove those events - however I would recommend to raise this with McAfee to confirm and perform such an action only with their support.

0 Kudos
DavHio
Level 9

Re: Failed deleting DLP events from database

Yes, I made a SR to McAfee now.

Thanks for replying.

/David

0 Kudos
vimalnavis
Level 13

Re: Failed deleting DLP events from database

Like MGG suggested, if you have already provided full access to the account that you use to log in to the machine, then the only effective option is to delete those events directly from the database.

Ensure that you do it using McAfee support.

0 Kudos
DavHio
Level 9

Re: Failed deleting DLP events from database

Since the DLP monitor didnt update the filters for our upcomming monthly report, probably because of the amount of events, I had to delete all events.

Now, for the future, is there any way to schedule a purge of the DLP database from within the ePO? We are using the Purge Client Events and Purge Threat Event Log but I cant see any built in options for purging DLP events.

Any suggestions?

Thanks

David

0 Kudos
vimalnavis
Level 13

Re: Failed deleting DLP events from database

v9.3 introduces purge task option for DLPe using ePO.

If you have any version prior to that, then no, there is not an ePO based option to purge DLPe events