How to Purge ePO events in the DB

[anonn]

How do I  Purge ePO events in the DB, I have tried the below statements and they still do not work, please assist

SET rowcount 10000

DELETE FROM epoEvents

WHERE detectedutc < '2015-06-01'

WHILE @@rowcount > 0

BEGIN

DELETE FROM epoEvents

WHERE detectedutc < '2015-06-01'

END

SET rowcount 0

GO

Delete from OrionAuditLog where StartTime  < (GetDate() - 90)

[moekhass]

​, Welcome to McAfee community. Please see this kb McAfee Corporate KB - How to remove old events and shrink the ePolicy Orchestrator database KB68961

and possibly McAfee Corporate KB - ePolicy Orchestrator 5.x database size warning during upgrade KB79561

You can also do it from ePO console. You need to create a server task. You can then schedule it to run every month or as needed.

[vmnguyen]

Anyone got the new SQL statement for EPO 5.10?

[vmnguyen]

Looks like the same statement will work, but you just need to select the Event database and run it.

SET rowcount 10000
DELETE FROM epoEvents
WHERE threateventid = '1095'
WHILE @@rowcount > 0
BEGIN
DELETE FROM epoEvents
WHERE threateventid = '1095'
END
SET rowcount 0
GO

[cdinet]

It is preferable to purge them using a server task in epo rather than directly from the database.  However, if you do use one of the queries mentioned, please keep in mind that different versions of epo have different table names for the events, such as epoevents vs epoeventsmt. 

What is the purpose of purging through sql vs the epo server tasks?

[vmnguyen]

In some cases, purging using SQL is faster and more convenient. We had some events that were not set to purge and had 100+ milliion events.

[cdinet]

That would make sense in that scenario

[sw41]

Do we also need to purge EPOProductEvents?  Our pre-upgrade script also called out that database.  I am guessing the same sql as above but from EPOProductEvents

[cdinet]

Yes, you would.  Validate also column names, as they may be different.

[SWISS]

"You can also do it from ePO console. You need to create a server task. You can then schedule it to run every month or as needed."

Yes but for his case maybe:

ONLY if he has:

a) SPACE on Disks

b) ENOUGH Limit on the SQL

c) LIMIT if SQL Express according to Version not reached

The he has to go with OSQL.exe Commandline tool as example and shrink or cut events step by step in 100-500 at once.