ePO 5.10 Unexpected Error Event Parser service refuses to start

[avilt]

I have installed ePO 5.10 with ENS, worked fine for 2 days.

Now when accessing the dashboards page in ePO, the following message displays:

An unexpected error occurred.

Also ePO 5.10 Event Parser service refuses to start under services.
I have explored the workaround from the following link, but No Count
option is not selected.

https://kc.mcafee.com/corporate/index?page=content&id=KB91124&actp=null&viewlocale=en_US&locale=en_U...


Under core:config, the test connection is successful.

What else can be the problem, no change performed on the server.

[Thussain]

Thank you for posting your query

Could you let me know what error message do you see in Eventparser.log file

The log is located at c:\programfiles(x86)\McAfee\Epo\DB\Logs\Eventsparser

Could you confirm what account are you using to start the event parser service, did you change the password for the account. 

[cdinet]

Did anything change at all on the sql server, such as Windows updates, a reboot, etc?  When core/config successfully tests but eventparser still won't start, then the first thing to check is whether the sql server is using dynamic or static ports.  Sometimes on a reboot, the dynamic port can change.  You can test that by going to sql configuration manager, sql server network configuration, protocols for your sql instance name, then double-click on tcp/ip.  Click on the ip addresses tab, then scroll to the bottom.  IPALL section will show you the actual port it is using and whether it is dynamic or not.  If the port has changed, then update that in your core/config.  If the instance name is mssqlserver (the default), in core/config, make sure your instance name is blank.

If none of that helps, then find out what changed.

[avilt]

TCP/IP port is dynamic, when I restart a new dynamic port is assigned, The SQL instance name is SQLEXPRESS.

Please find attached the required logs.

[cdinet]

I would set sql to use static ports instead of dynamic so you don't run into this and restart sql services.  Once you do that, restart epo services, then go to core\config and reset the port there.  So your core\config page should reflect sqlexpress as your instance and the correct port that is in sql config mgr.

[avilt]

It resolved my issue but is it a mandatory requirement, is it documented?

[cdinet]

No, it is not in a KB - I can write one for it when I get a chance.  But, the sql port is a requirement to be the correct port in core/config.  It is the nature of sql when using dynamic ports, that it can change.  This can cause connection problems with any application connecting to that sql server, regardless of whether it is epo or any other 3rd party application.  Setting it to static prevents the random disconnects when that port changes dynamically.