cancel
Showing results for 
Search instead for 
Did you mean: 

This ePolicy Orchestrator server has more than 10,000 unprocessed events, which may cause the upgrade process to take an exceptionally long amount of time.

Does anyone of you is able to give me some advices about what events it?


upgrade ePo 4.6.8 do 5.1.1


McAfee ePolicy Orchestrator 5.1.1

---------------------------

This ePolicy Orchestrator server has more than 10,000 unprocessed events, which may cause the upgrade process to take an exceptionally long amount of time.

12 Replies
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 13

Re: This ePolicy Orchestrator server has more than 10,000 unprocessed events, which may cause the upgrade process to take an exceptionally long amount of time.

Hello Pawel,

                     I am trying to understand your first question but more interested in you comment regarding the upgrade from 4.6.8 to 5.1.1. Here are some very specific questions that may take us closer to why your asking about the excessive time and events.

1. How big was your database before you attempted to upgrade?

2. Did your upgrade compatibility run successfully?

Let's start there.

Jay

Re: This ePolicy Orchestrator server has more than 10,000 unprocessed events, which may cause the upgrade process to take an exceptionally long amount of time.

Answer:
- The database is 2.67 GB.

- Yes, i did upgrade compatibility run successful.


PK

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 13

Re: This ePolicy Orchestrator server has more than 10,000 unprocessed events, which may cause the upgrade process to take an exceptionally long amount of time.

So far so good. Your database is tiny and the pre-check is aok. Moving forward;

1. The events you spoke of, did you detect the 10K events from the events folder?

2. Are the dates of those events current or older than a week?

3. How many clients you managing with ePO?

4. How much memory?

5. How many CPU's?

Jay

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 13

Re: This ePolicy Orchestrator server has more than 10,000 unprocessed events, which may cause the upgrade process to take an exceptionally long amount of time.

The link above goes to a dashboard that you can import and give you a better idea of how events are distributed via ePO.

2014-08-26_23-02-43.jpg

Re: This ePolicy Orchestrator server has more than 10,000 unprocessed events, which may cause the up

Hi ja2013,

Can you please forward me the dashboard for db events "EPO- Database Growth"

Can't find it anywhere.

 

Thx

Re: This ePolicy Orchestrator server has more than 10,000 unprocessed events, which may cause the upgrade process to take an exceptionally long amount of time.

The content in KB article KB79561 should help answer your questions: McAfee KnowledgeBase - ePolicy Orchestrator 5.1 database size warning during upgrade

The reason you see this message is explained in the KB, but I will share it here — if upgrading to 5.1.1 from ePO 4.x version there is a check made against the DB tables listed below.

 

  • EPOEvents
  • EPOProductEvents
  • EPORollupEvents
  • EPORollupProductEvents
  • OrionServerTaskLogDetail
  • OrionAuditLog

If any the tables listed will be modified by the ePO installer and have over one million rows, a warning message displays before the installation starts. The SQL server needs significant reserve disk space to apply the schema changes to these tables. These changes take significant time to complete, causing the ePO upgrade to potentially run for many hours.

This is the message that displays at the start of the upgrade:

DBEventTables_TooLarge.png

You should purge those event tables listed above prior to upgrading to help decrease the time it takes for the upgrade to complete. You should be able to create Server Tasks that will do this for you. Here's a partial screen shot of the Server Task Builder actions list that includes several purge event selections. FYI, the table ePOProductEvents contains client events, the table EPOEvents contains Threat Events.

ServerTaskBuilder_PurgeEvents.png

Hope this helps,

~ Patt ~

hem
Level 15
Report Inappropriate Content
Message 8 of 13

Re: This ePolicy Orchestrator server has more than 10,000 unprocessed events, which may cause the upgrade process to take an exceptionally long amount of time.

If you have unprocessed events accumulated into \DB\Events folders then before upgrade.

1. Please stop Event parser service.

2. Cut and paste \Events folder outside ePO directory.

3. Please start Event parse service and run installer.

Re: This ePolicy Orchestrator server has more than 10,000 unprocessed events, which may cause the upgrade process to take an exceptionally long amount of time.

thank you for the hint.
I will apply your suggestions and let you know about the effects of work.


PK

Re: This ePolicy Orchestrator server has more than 10,000 unprocessed events, which may cause the upgrade process to take an exceptionally long amount of time.

effect of changes in Annex end_instalation.pngmessage