We found our ePO server's "C" drive having free space about 50 GB (it has 290 GB capacity).
On further analysis of folders on C drive, C:\Programfiles\McAfee\ePO\DB\Events has lots and Lots of *.PKG and *.XML files which sizes about 115GB.
After refering from the forum https://community.mcafee.com/message/161091#161091
we started Mcafee eventparser services , now all the files has been moved to C:\Programfiles\Mcafee\ePO\DB\Events\Debug folder.
Can we delete these files manually to release some space on the hard drive ?
Will it affect the ePO 's functionality?
ePO Server Configurations
Windows Server 2003 R2 , Mcafee ePO 4.6.1
At the moment these events have not been processed into the ePO DB. You can delete these events if you wish, but of course this means that they will be gone forever. As long as that's OK with you, go ahead.
It might be worth checking the eventparser log to see if there are problems processing events - if there are then the problem may reoccur.
You can delete these events with event parser service stopping, only thing is you will not able to view client and Thret event logs on those machines. This issue occur when huge multiple events came to ePO console and ePO was unable to dump those into DB. Try to analyze incoming events and try to reduce unwanted events by removing report option in AP or Event Filtering in ePO settings, this will improve ePO functionality.
On EPO 5.9.1, my HDD space is full because of a huge amount of .xml files into the Debug folder. I tried to stop the EventParser service to realease some space but the logs keep going into the folder.
I'm not familiar with EPO, what can I do ?
The Events are "BlockEvents" with the RuleName "Common Standard Protection: Prevent modification of McAfee files and settings".
Many thanks for the help
There are 2 things to look at. when did the issue start and what changed?
1. Do you have the issue listed in kb91418?
2. What errors do you see in the eventparser log?
You can look up the events for that rule and see what process or processes are triggering it the most and possibly add it as an exclusion or disable that rule from flooding your server. The .pkg files are unprocessed, unextracted events and the xml's are extracted, waiting to be parsed events in the root of the events folder. When they go to debug is when they fail to parse for one reason or another.
Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?