cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
mjmurra
Level 12
Report Inappropriate Content
Message 1 of 3

SQL scripts to determine (and purge) highest database usage

Jump to solution

I know this has been posted here before.... But can't easily find it.

What's the easiest SQL script to run to determine which Event ID is causing huge database size issues?

What's the easiest way to purge the Event ID/Events causing large database issues?

1 Solution

Accepted Solutions
McAfee Employee JoeBidgood
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: SQL scripts to determine (and purge) highest database usage

Jump to solution

mjmurra wrote:

I know this has been posted here before.... But can't easily find it.

What's the easiest SQL script to run to determine which Event ID is causing huge database size issues?

Something like this should do the trick - it'll give the top 5 most common events:

    select top 5 epoevents.threateventid as 'Event ID',
    count(*) as 'Count'
    from epoevents
    group by threateventid
    order by count(*) desc

What's the easiest way to purge the Event ID/Events causing large database issues?

Easiest way is probably to write a query to return the event ids you're interested in, and then run this query from a "Purge Threat Events" server task.

HTH -

Joe

2 Replies
McAfee Employee JoeBidgood
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: SQL scripts to determine (and purge) highest database usage

Jump to solution

mjmurra wrote:

I know this has been posted here before.... But can't easily find it.

What's the easiest SQL script to run to determine which Event ID is causing huge database size issues?

Something like this should do the trick - it'll give the top 5 most common events:

    select top 5 epoevents.threateventid as 'Event ID',
    count(*) as 'Count'
    from epoevents
    group by threateventid
    order by count(*) desc

What's the easiest way to purge the Event ID/Events causing large database issues?

Easiest way is probably to write a query to return the event ids you're interested in, and then run this query from a "Purge Threat Events" server task.

HTH -

Joe

mjmurra
Level 12
Report Inappropriate Content
Message 3 of 3

Re: SQL scripts to determine (and purge) highest database usage

Jump to solution

Thanks once again Joe!

Top eventID at this site has 3.1 million entries in the database (failure to scan encrypted file)....  Second top is 1 million (Would be blocked by AP)

There definately needs some selective purging done on the database, and some event filtering implemented.

BTW - does anyone know how much space (on average) an event uses in a SQL database? How much should the database reduce by after removing 3.1 million events and then performing maintenance?


Message was edited by: mjmurra on 8/02/11 9:39:15 PM
More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community