MA 5.6.0 HF1264214 can experience a problem where the same client events are uploaded to the ePolicy Orchestrator (ePO) server repeatedly. The flood of events results in the following issues:
A backlog of unparsed events in the ePO_InstallDir\Db\Events\ folder on ePO server and remote handlers.
Reduced performance of the ePO server or remote Agent Handler.
Disk space usage issues:
On the ePO server – caused by the backlog of events referenced in the first bullet item above.
On the SQL database – caused by the successful parsing of the flood of events.
The masvc_systemname.log file, located in the Agent data directory (ProgramData\McAfee\Agent\logs by default on Windows), reports the following error removing events from the local Agent database during upload:
event.Critical: Failed in ma_db_transaction_begin, error = 217
Installed or upgraded to MA 5.6 HF1264214 (Build 220.127.116.118).
MA is unable to obtain a transaction lock on the MA database and remove events that have already been uploaded. This issue happens when the client computer is put to sleep while the Agent is committing changes to the local database files.
Technical Support is investigating this issue. As a temporary measure, implement the following workaround.
Agent 5.6.1 looks to be out now, I am hopeful this will resolve this issue and we can start to turn the events back on? (Although we've just left the specific events turned off for 2 months now without any major overloads since doing that!)
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.