Showing results for 
Search instead for 
Did you mean: 

HIPS Stored procedure HIP8SP_UpdateHIPProperties trashing SQL

We have been seeing for some time that this procedure is trashing ePO 5.3.2. McAfee cannot even tell us what it does, but I sense it runs each time somethig 'touches' HIPS. Like you run a query which includes the HIPS patch level. If you run a standard report in SQL for 'Object Execution Statistics' you may see millions of IOs against the SP. One of McAfee asnwers was to disable the SP, but they were unable to tell me what the impact of that it. Still, I do it during the day, else ePO is typically too slow to use.

We have no adaptive mode stuff.

I would appreciate input from others from the SQL report - maybe you have it too?


Labels (2)
2 Replies
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: HIPS Stored procedure HIP8SP_UpdateHIPProperties trashing SQL

Hi Andrew,

Dev answered what it does when you had a case open for this. 

Hips updates product properties in every 60 seconds which will force to run HIP8SP_UpdateHIPProperties in every 60 seconds.  The procedure is syncing the HIP8_Properties table with HIP properties sent by end nodes, so the properties can be reported on in Dashboards and Queries.

You were given a script to update the procedure.  The original procedure had many joins, this has been reduced in the script provided.

Have you tested that script?

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?


Re: HIPS Stored procedure HIP8SP_UpdateHIPProperties trashing SQL

Yes, we tested the new script and I originally said it looked good, but then said the problem came back. DEV never explained why we would get 35 miliion IOs from it or what the true impact of stopping the procedure would be (although you guys were happy to suggest that we just stop it). I recently stopped it for a while and you will see I have another SR in process where the HIPS Status was showing as Unknown in a query for about 3000 systems - seems to be fixed by enabling the procedure - so I am guessing it does that at least.

We will be upgrading to 5.10 soon, so I am not sure there is much point doing a great deal more on this beforehand.


More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator