EPExtendedEventMT table

[helenelliott]

Hi All

Over the past few weeks we have seen a large amount of growth in our ePO DB.

The largest table is EPExtendedEventMT and is currently sat around 323GB , I have purged events / logs right up to the last 30 days but these have had no effect on this table and it continues to grow.

When viewing the table it looks like it holds data for alerts that have been generated but unsure how to purge any of this data.

Have a call logged with McAfee, hopefully find where the issue lies.

Regards

[LKS]

Hi helenelliott,

Hope our engineer is already in touch with you in regards to this. However additional i would like to give some more information. Never ever delete any events

I should mention that the EPEExtendedEvents table should have a FK to the EPOReferenceEvents table with a cascade delete, meaning when you delete the row from the EPOReferenceEvents table it should delete the corresponding row in the EPEExtendedEvents table. 

Also may i know what is the Agent version are you using.

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a Solution" if this reply resolves your query!

[cdinet]

How specifically are you purging your events - through a script in sql or through a purge task in epo?  In epo 5.10, you can't just run a script to purge events from the events table, as it will leave orphaned event data in other tables.  If you ran the script in sql to purge events, send me your case number and I can send you a script to purge the orphaned events, which would affect that table.