cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

..\DB\Events folder is filling with *.Pkg and .xml files for about 115GB

Dear All,

     We found our ePO server's "C" drive having free space about 50 GB (it has 290 GB capacity).

     On further analysis of folders on C drive, C:\Programfiles\McAfee\ePO\DB\Events has lots and Lots of *.PKG and *.XML files which sizes about 115GB.

     After refering from the forum https://community.mcafee.com/message/161091#161091

           we started Mcafee eventparser services , now all the files has been moved to C:\Programfiles\Mcafee\ePO\DB\Events\Debug folder.

          Can we delete these files manually to release some space on the hard drive ?

           Will it affect the ePO 's functionality?

          ePO Server Configurations

          Windows Server 2003 R2 , Mcafee ePO 4.6.1

4 Replies
McAfee Employee JoeBidgood
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: ..\DB\Events folder is filling with *.Pkg and .xml files for about 115GB

At the moment these events have not been processed into the ePO DB. You can delete these events if you wish, but of course this means that they will be gone forever. As long as that's OK with you, go ahead.

It might be worth checking the eventparser log to see if there are problems processing events - if there are then the problem may reoccur.

HTH -

Joe

Reliable Contributor ansarias
Reliable Contributor
Report Inappropriate Content
Message 3 of 5

Re: ..\DB\Events folder is filling with *.Pkg and .xml files for about 115GB

Hello,

You can delete these events with event parser service stopping, only thing is you will not able to view client and Thret event logs on those machines. This issue occur when  huge multiple events came to ePO console and ePO was unable to dump those into DB. Try to analyze incoming events and try to reduce unwanted events by removing report option in AP or Event Filtering in ePO settings, this will improve ePO functionality.

Re: ..\DB\Events folder is filling with *.Pkg and .xml files for about 115GB

Hello,

 

On EPO 5.9.1, my HDD space is full because of a huge amount of .xml files into the Debug folder. I tried to stop the EventParser service to realease some space but the logs keep going into the folder.

 

I'm not familiar with EPO, what can I do ?

The Events are "BlockEvents" with the RuleName "Common Standard Protection: Prevent modification of McAfee files and settings".

 

Many thanks for the help

 

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 5 of 5

Re: ..\DB\Events folder is filling with *.Pkg and .xml files for about 115GB

There are 2 things to look at.  when did the issue start and what changed?

1. Do you have the issue listed in kb91418?

2. What errors do you see in the eventparser log?

You can look up the events for that rule and see what process or processes are triggering it the most and possibly add it as an exclusion or disable that rule from flooding your server.  The .pkg files are unprocessed, unextracted events and the xml's are extracted, waiting to be parsed events in the root of the events folder.  When they go to debug is when they fail to parse for one reason or another.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community