cancel
Showing results for 
Search instead for 
Did you mean: 
zain
Level 7
Report Inappropriate Content
Message 1 of 6

DB\events folder eating up space

Hi,

Environment - windows Server 2003 r2(Virtual Machine), ePO 4.5, SQL 2005 on cluster

In the epo install folder \DB\events, there are over 1 million .xml and .pkg files which is eating up all the disk space on the server. Below is a copy sample of the event parser log file which continuously generates the same error. Can anyone help.

20100407091603    E    #2928    EVNTPRSR    server_ProcessXMLFile: COM Error :80004005 server_ProcessXMLFile
20100407091603    E    #2928    EVNTPRSR    Meaning = Unspecified error
20100407091603    E    #2928    EVNTPRSR    Source = (null)
20100407091603    E    #2928    EVNTPRSR    Description = (null)
20100407091603    I    #2948    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002dedaeca-f204-437e-a0db-18402773d796-20100406065149697787600000790.xml succeeded (IEPOBllExt)
20100407091603    I    #2908    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002e3ebf17-8889-4083-b76f-b0b289d6d3eb-20100407002514775936100000658.xml succeeded (IEPOBllExt)
20100407091604    I    #2936    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002ed788b5-46dc-458b-a199-fbfb83fa9d43-20100406185002671425000000EC4.xml succeeded (IEPOBllExt)
20100407091604    I    #2920    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002e172d9c-6cba-4cfa-8f38-7dcce0bc7a22-20100403020444822218300000790.xml succeeded (IEPOBllExt)
20100407091604    I    #2960    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002e67d904-eab6-48ba-ae1a-790f255412aa-20100405140011665930100000790.xml succeeded (IEPOBllExt)
20100407091604    E    #2928    NAEPODAL    CEPODAL::ExecQuery: COM Error(0x80040E07) Error converting data type varchar to uniqueidentifier.
20100407091604    E    #2928    VseBll      DAL->ExecQuery failed. hr=80040e07
20100407091604    E    #2928    EVNTPRSR    server_ProcessXMLFile: COM Error :80004005 server_ProcessXMLFile
20100407091604    E    #2928    EVNTPRSR    Meaning = Unspecified error
20100407091604    E    #2928    EVNTPRSR    Source = (null)
20100407091604    E    #2928    EVNTPRSR    Description = (null)
20100407091604    I    #2924    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002ef3d2f7-87e0-4608-a8c9-7be135db1e38-20100407003034939943100000C6C.txml succeeded (IEPOBllExt)
20100407091604    I    #2944    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002dc4d91f-f2e6-4b4a-9282-a3fb64cb30be-2010040701190468272280000084C.xml succeeded (IEPOBllExt)
20100407091604    I    #2940    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002e54871b-2664-4121-8a18-81d27507d162-20100403204729103166700000790.xml succeeded (IEPOBllExt)
20100407091604    I    #2916    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002dcdfd21-6110-41a0-8e9b-0dd322b59617-201004061711514849637000003CC.xml succeeded (IEPOBllExt)
20100407091604    I    #2964    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002efa5847-f5d4-4c58-8671-9158ecbc23cf-20100406232600281576000001190.xml succeeded (IEPOBllExt)
20100407091605    I    #2908    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002e3ebf17-8889-4083-b76f-b0b289d6d3eb-20100407002520275729200000658.xml succeeded (IEPOBllExt)
20100407091605    I    #2948    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002dedaeca-f204-437e-a0db-18402773d796-20100406065155197677100000790.xml succeeded (IEPOBllExt)
20100407091605    E    #2928    NAEPODAL    CEPODAL::ExecQuery: COM Error(0x80040E07) Error converting data type varchar to uniqueidentifier.
20100407091605    E    #2928    VseBll      DAL->ExecQuery failed. hr=80040e07
20100407091605    E    #2928    EVNTPRSR    server_ProcessXMLFile: COM Error :80004005 server_ProcessXMLFile
20100407091605    E    #2928    EVNTPRSR    Meaning = Unspecified error
20100407091605    E    #2928    EVNTPRSR    Source = (null)
20100407091605    E    #2928    EVNTPRSR    Description = (null)

5 Replies

Re: DB\events folder eating up space

The events queue is dynamic, but 1,000,000 in this folder seems excessive. These events are effectively unprocessed - you can delete them if you wish but you lose the associated data for reporting in doing so.

The log snippet shows the event parser is working though, for example:

20100407091604    I    #2920    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002e172d9c-6cba-4cfa-8f38-7dcce0bc7a22-20100403020444822218300000790.xml succeeded (IEPOBllExt)

The error suggests that ePO does not understand something in these other event files:

20100407091604    E    #2928    NAEPODAL    CEPODAL::ExecQuery: COM Error(0x80040E07) Error converting data type varchar to uniqueidentifier.
20100407091604    E    #2928    VseBll      DAL->ExecQuery failed. hr=80040e07
20100407091604    E    #2928    EVNTPRSR    server_ProcessXMLFile: COM Error :80004005 server_ProcessXMLFile
20100407091604    E    #2928    EVNTPRSR    Meaning = Unspecified error
20100407091604    E    #2928    EVNTPRSR    Source = (null)
20100407091604    E    #2928    EVNTPRSR    Description = (null)

VseBLL suggests these are from VirusScan. If you wish, find the oldest one in the list and open it up for review to see which component it has come from for sure.

Otherwise make sure you are up to date with your VirusScan extensions in the ePO console, as this is where the event format is described

.

With so many events to process, it will take some time to clear and process and the ePO DB is going to grow somewhat. It may be simpler to back them off somewhere then reinsert to the events folder in smaller numbers.

You should probably stop the ePO services while doing that.

Rgds,

Rob.

Highlighted
zain
Level 7
Report Inappropriate Content
Message 3 of 6

Re: DB\events folder eating up space

With over a million files in the events folder, windows doesnt even allow me to open it. It just hangs which would make moving them out the moving the back in extremely tedious. I have found some other posts where it was advised to reinstall the virusscanreports extention with the latest version. I stopped the Mcafee server and services and did this. Does stopping the event parser service make handling the DB\Events folder easier?

Regards,

Zain

Re: DB\events folder eating up space

It'll stop any more events being added (but also stop any being processed through to the database).

If you have just upgraded the reports extension you will need to keep the services running to keep ePO processing events.

It's going to take quite a while to get through that many. Check the log to see if the error continues, then you will know if the extension has helped.

Rgds,

Rob.

zain
Level 7
Report Inappropriate Content
Message 5 of 6

Re: DB\events folder eating up space

After removing some of the files in the events folder, checked in the vse 8.7 and extention, the following error appears in the log continuously and there are no events that are 'successful'. I have logged a support call with Mcafee to see what they say.

20100408091646    E    #5164    NAEPODAL    CEPODAL::ExecQuery: COM Error(0x80040E07) Error converting data type varchar to uniqueidentifier.
20100408091646    E    #5164    VseBll      DAL->ExecQuery failed. hr=80040e07
20100408091646    E    #5164    EVNTPRSR    server_ProcessXMLFile: COM Error :80004005 server_ProcessXMLFile
20100408091646    E    #5164    EVNTPRSR    Meaning = Unspecified error
20100408091646    E    #5164    EVNTPRSR    Source = (null)
20100408091646    E    #5164    EVNTPRSR    Description = (null)

Re: DB\events folder eating up space

I am going through a similar issue,though my event logs are HDLP based.Have you been able to fix this issue.If so what was the resolution.

Thanks         

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community