ePO 5.9.1 have some critical issues encountered

[vnaidu]

Dear All,

I would need your advice to proceed with the ePO upgrade. We are running ePO 5.9.1 and we decided to upgrade. The below is the existing configuration.

1. Current running ePO 5.9.1 on a cluster environment with 4 Agent Handlers running with ePO 5.9.1.

2. When we attempted to upgrade the ePO 5.9.1 from an active cluster following McAfee document :

https://docs.mcafee.com/bundle/epolicy-orchestrator-5.10.0-installation-guide/page/GUID-2A206891-AA7...

3. When we ran the setup file, we are not getting the option to click on "Next" button and it stays for hours with no progress.

4. Then it throws an exception stating that "The ePO server has more than 10,0000 unprocessed events which may cause the upgrade process to take an exceptionally  long amount of time. We recommend that you allow these events to be processed or delete them before attempting the upgrade again"

5. So we tried to rename the Debug folder located on <Install Directory>\McAfee ePO\DB\Events\Debug folder to Debug_old

6. Because the size of the Debug folder is more than 150 GB.  So we renamed the Debug folder and created a new folder with name Debug.

7. Again we ran the setup file to receive the error mentioned in the above step 4. 

8. So we again decided to move the xml files created in Debug folder to a different drive but it is not easier than said. As it is taking more time than expected as it could move only 5 GB a day.

9. At the same time the files are being moved to Debug_old as well, it looks weird and causing more confusion over the issue.

Can anyone help me get out of this weird situation. We would like to complete the upgrade in a smoother way rather than encountering all these issues, but I accept that these challenges are learnig lessons. 

This is my first attempt to upgrade ePO from a cluster environment. Please guide me to complete the activity.

Any help is much appreciated.

Regards,

[Thussain]

Thank you for posting your question here

I request you to kindly make a copy of your events folder and move it to another location. 

Stop the event parser service

move the events folder to another location

Start the event parser service, then try to proceed with the upgrade. 

Also check the size of your DB and try reducing it 

[vnaidu]

@Thussain 

Thank you for the swift reply.

I attempted to stop the event parser service as suggested. Since this is a cluster environment, the service is getting started on the other server and we could not achieve this. We could not move the events as it takes long time. 

Kindly suggest me with any alternative work around to get this bye passed.

Regards,

[cdinet]

I would suggest first turning off eventparser, then open command prompt as administrator.  Change directory to the events\debug directory and run del *.* and then do the same for the debug folder you created, and delete that backup folder.  Those events won't be processed anyway, so there is no need to retain them.  

If you do need to retain them, then it is much more efficient to copy them via the command prompt, but don't copy them to any backup directory within the epo install directory.

[vnaidu]

@cdinet @Thussain 

Thank you very much for the valuable advice, as suggested we were able to delete them as we do not require them and now we are about to run the upgrade setup file. I would keep you posted about the status.

Many thanks for the suggestion. 

Regards,

[cdinet · Accepted solution]

Good luck with it!  Hope all is successful.