Excessive Table Size for EPODataChannelDataMT

[Nick_B]

Dear McAfee Community,

We have a customer with an unusual issue whereby one of the tables in their ePO DB grows to ridiculous proportions - when I was discussing the issue with them today they reported this table to be about 300GB (122,211 rows). The table in question is EPODataChannelDataMT.

The issue they're experiencing is described in KB90920.

Below is the first scenario as described in the aforementioned KB:

Extract from KB90920

 And the results of that query are below:

Query Results

Their environment consists of about 5,000 managed endpoints (roughly 500 of which have Drive Encryption installed, v7.2.5), McAfee Agent 5.6.1 (mainly) and ENS 10.6.1. There are no reported issues of users being unable to login through the Pre-Boot Authentication (PBA) screen.

The ePO version is 5.10.0 Update 4 (applied recently). Previously they were on 5.3.2.

SQL version is 2016 (full version). Recovery model is Simple.

File growth is set to 200MB.

The SQL Server is a Shared one with around 70 or so other DBs residing there, some of which are not in use. No reported issues with the other DBs - that is, as long as the ePO server is rebooted daily, otherwise the other DBs are affected as the SQL server reaches breaking point and almost collapses.

Arithmetic Abort is set to True.

Auto close if off.

Collation is SQL_Latin1_General_CP1_CI_AS.

Also on the phone today the customer mentioned that this issue is not "new" as such and has been around in some form or other for a number of years - at least since 5.3.2 days.

The workaround they have in place is a scheduled task which reboots the ePO server on a daily basis, which usually (but not always) has the effect of shrinking the table back to normal size. Other times it only reduces partially in size, say back down to 24GB or so.

Looking forward to your thoughts guys!

[cdinet]

What version of epo? Check to see if the dbcleanup task is running properly - kb84114. First confirm you have that issue or not by following the workaround step 2. If you do have that issue, we should probably get the table truncated first before proceeding with kb84114. Attached is a script for that, but be sure to back up everything per kb66616 first and follow any commented instructions in the script. This would cover all the current versions of epo.

[Nick_B]

Hi Caryn,

Sorry, the ePO info was buried a bit further down.

It's 5.10.0 Update 4, the very latest.

[cdinet]

That's ok, make sure to go through the steps I gave you then.