EPExtendedEventMT table

[stevechmiewlisk]

Hi All

Over the past few weeks we have seen a large amount of growth in our ePO DB.

The largest table is EPExtendedEventMT and is currently sat around 323GB , I have purged events / logs right up to the last 30 days but these have had no effect on this table and it continues to grow.

When viewing the table it looks like it holds data for alerts that have been generated but unsure how to purge any of this data. 

Have a call logged with McAfee, hopefully find where the issue lies.

Regards

Steve

[rgc]

Mandatory take the complete ePO FULL db backup before performing any steps.

To delete events from epoevents, which will remove relational rows from epoeventsreference,
which will cascade events from the EPExtendedEventMT table

Run the query below for ePO 5.10 to get this reduced the events written, NOTE verify the ePOEvents what event ID is filled up for ENS, which will lead to get EPExtendedEventMT table to huge....
-------------------------------------------------------------------------------------------

while (@@ROWCOUNT > 0)

begin

       delete top (100000) from EPOEventsReference

       where AutoID not in

       (select AutoID from EPOEvents)

end
-------------------------------------------------------------------------------------------

[cdinet]

If that doesn't do as expected, you can also try this one that is attached.