cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
markgarza
Level 10
Report Inappropriate Content
Message 1 of 12

ePO_Events_log.ldf taking up a lot of space, how to purge?

Hi all, often run into problems where the EPO databases grow in size very large and eventually end up taking up the entire disk they're on. We have sort of mitigated the impact by placing the DBs on a separate drive on our DBMS server, but the problem seems to have returned this morning.

I'm seeing that our _events_log.ldf file is 900GB in size, by far the largest of our EPO DBs. What is in this database file/can we purge events from it to make more room? How can I see what we'd be purging?

All of our Purge server tasks started failing as of two days ago, so those won't work. 

11 Replies
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 12

Re: ePO_Events_log.ldf taking up a lot of space, how to purge?

Is the events database using simple or full recovery model?  If full, you should be backing up the transaction log probably every 15 minutes possibly.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

markgarza
Level 10
Report Inappropriate Content
Message 3 of 12

Re: ePO_Events_log.ldf taking up a lot of space, how to purge?

Our main EPO database is in Simple mode, our Events database is in Full mode. I will look into the process for backing up the transaction log.
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 12

Re: ePO_Events_log.ldf taking up a lot of space, how to purge?

Once you do back it up, if space is not reclaimed, you can then shrink the log file by right-clicking on the events db, shrink, files, then choose the transaction log file.  Don't shrink it until you have done a backup though.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

markgarza
Level 10
Report Inappropriate Content
Message 5 of 12

Re: ePO_Events_log.ldf taking up a lot of space, how to purge?

Thanks for that info. I've found this for backing up the transaction log: https://docs.microsoft.com/en-us/sql/relational-databases/backup-restore/back-up-a-transaction-log-s...

Am I correct in that I need to find somewhere else to store this 900GB file in full? And then be able to store any appendages to that file as well in the future, to whatever size that may grow the file to?

I see you say every 15 minutes, is this the part where it says "backup set will expire in x days?" If so, I only have the option to do so in days, at least in this wizard I'm looking at.
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 12

Re: ePO_Events_log.ldf taking up a lot of space, how to purge?

You might need to have room for at least one backup, but any future backups would not need it.

Per KB67184:

Full Recovery Model:
After backing up the Transaction using the Full Recovery model, SQL Server flags backed-up records as Inactive and truncates the log. In this way, any new operations that are logged to the Transaction log, can reuse that space by overwriting the inactive entries. This design helps to prevent the log size from growing.

If no periodic backup of the Transaction log is done, the size of the Transaction log continues to grow until it consumes all available disk space. So, if your ePO database is configured to use the Full Recovery model, it is important to perform regular Transaction log backups to keep its size in check.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

markgarza
Level 10
Report Inappropriate Content
Message 7 of 12

Re: ePO_Events_log.ldf taking up a lot of space, how to purge?

I understand that the backup frees space within the .ldf itself, resolving my original issue, but whatever separate storage I put this backup on would need to be able to handle the backup increasing in size indefinitely as the backups continue to run in the future and append to the backup, correct? Or am I understanding that wrong?
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 12

Re: ePO_Events_log.ldf taking up a lot of space, how to purge?

This might help understand how to manage that.

https://www.sqlservercentral.com/forums/topic/estimating-the-disk-space-needed-for-performing-transa...

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

markgarza
Level 10
Report Inappropriate Content
Message 9 of 12

Re: ePO_Events_log.ldf taking up a lot of space, how to purge?

Thanks for that, not exactly a SQL admin so I'm learning as I go here, definitely helpful info.

Looking at this KB: https://kc.mcafee.com/corporate/index?page=content&id=KB76720

When I ran that query against our main EPO database, it seems that event ID 1095 has the largest count. I know that it says to run it against the main EPO database but am I right in that these results are actually referring to events in the _Events database? And therefore if I purge them it will make space in the _Events database? But I guess even at that point, it won't necessarily help the .ldf log file, actually will add more transactions to that log file thus increasing the size, correct?

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 10 of 12

Re: ePO_Events_log.ldf taking up a lot of space, how to purge?

You are correct, until the transaction log issue is resolved, the more transactions you do, especially purging, it will increase the log size.  

All purging and querying should be done against the main db, as there is a symbolic link tying the 2 db's together, so queries run against the main db will reference items also in events db.  If you restore one, you need to restore both, for example, for same time frame, otherwise you get orphaned data.  

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community