cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
McADOC1
Level 7
Report Inappropriate Content
Message 1 of 3

purge evidence store error in server task log - Failed to access - Permissions?

Jump to solution

Hi,

Running purge on DLP 11.3.x to purge dlp history of operational events and incidents
i get this error in the server task log

Failed to access: \\mysystemEPO\dpl-data$\evidence\
and
Scan on evidence store \\mysystemEPO\dlp-data$\evidence\ Failed.Failed to access.


what is the best way to troubleshoot to clear error and purge evidence store.
i have the SYSTEM account on the share with read and full control for NTFS.
The share is on the epo server.

 

Also, there are old and incorrect evidence stores listed in the server task when it searched for stores.  How can i clear those out?

Thanks.

Labels (2)
1 Solution

Accepted Solutions
onedayoneapple
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 3

Re: purge evidence store error in server task log - Failed to access - Permissions?

Jump to solution

The reason you saw incorrect evidence shares in the server task log is because that server task will make tomcat service start to try to access all the evidence share entries used before, even those evidence shares are not being used anymore. there should have a db table store those entries. afaik seems no official documentation to describe how to clear it out.

If you are sure the permission configurations are correct (basically you need to add share permissions for the epo server computer account with full access to the evidence share), looks like the next step is going to review epo orion.log (maybe need to enable debug log for orion to see more details). orion.log is located at epo install dir\server\logs.

View solution in original post

2 Replies
onedayoneapple
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 3

Re: purge evidence store error in server task log - Failed to access - Permissions?

Jump to solution

The reason you saw incorrect evidence shares in the server task log is because that server task will make tomcat service start to try to access all the evidence share entries used before, even those evidence shares are not being used anymore. there should have a db table store those entries. afaik seems no official documentation to describe how to clear it out.

If you are sure the permission configurations are correct (basically you need to add share permissions for the epo server computer account with full access to the evidence share), looks like the next step is going to review epo orion.log (maybe need to enable debug log for orion to see more details). orion.log is located at epo install dir\server\logs.

McADOC1
Level 7
Report Inappropriate Content
Message 3 of 3

Re: purge evidence store error in server task log - Failed to access - Permissions?

Jump to solution

thanks.

needed computername in share.  had in ntfs only.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community