cancel
Showing results for 
Search instead for 
Did you mean: 

ePO performance issue

Jump to solution
Recently i have issue with ePO, the time taken to show up system details when I click on system name is very long. Also, inside the system details, when i click on different installed product, the time taken to show up the product detail is very long. Anyone facing the same issue?
1 Solution

Accepted Solutions
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 10 of 11

Re: ePO performance issue

Jump to solution

To start with, you must get off that .878 build of the agent - it has been pulled from the download site because of this issue.  That is not an option, it is absolutely necessary. You can either do a forceinstall of the 5.6.0.702 version, or call into support and get the hotfix version that fixes this and set up a deployment task.  If you don't, your database can get flooded with millions of events, cause drive space issues, server busy handling them all, possible deadlocks and other symptoms. 

Once you do that, support also has a script to remove the duplicate events that are being sent by that agent version.  As long as you have even one agent with that build, you have the potential for the event flooding. 

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

10 Replies
Highlighted
Reliable Contributor vnaidu
Reliable Contributor
Report Inappropriate Content
Message 2 of 11

Re: ePO performance issue

Jump to solution

@User81283447 

Start with the orion.log as it might be sql related.

 

Make sure that your SQL maintenance plan is running w/o error:

Recommended maintenance plan for ePolicy Orchestrator databases using SQL Server Management Studio

https://kc.mcafee.com/corporate/index?page=content&id=KB67184&actp=search&viewlocale=en_US&searchid=...

 

Performance issues with ePO and SQL on systems running more than one CPU

https://kc.mcafee.com/corporate/index?page=content&id=KB79310

If this information was helpful or has answered your question, please select Accept as Solution. This will assist other memebers
Venu

Re: ePO performance issue

Jump to solution

Normally I do not have any issues with queries / reports. only when i click on system name to show system details that make me wait.

McAfee Employee Hawkmoon
McAfee Employee
Report Inappropriate Content
Message 4 of 11

Re: ePO performance issue

Jump to solution

Hi User81283447,

As vnaidu mentioned above this might be dB related, the dB size is something that affects  performance.

I've attached a script for you to help you see if this is on this occasion. The script is something we use/issue in support to get information from a dB to see what the general state and size of the dB and its tables are to then suggest ways of reducing them, if possible to help improve performance.

Please feel free to collect review and use it, likewise you are free to save this for future use. 

Please do not modify it in any way, but as I say feel free to review it, you will see it only reads the dB and creates a text report of the dB as a 'Top 10 report', it makes no changes to your dB, it only reads.

Also please note this is version 4.2, we do release newer versions as time passes to improve the information it creates. So keep in mind 'support' may send you a newer version should you contact them and they seek this type of detail from you.

I'd suggest once the report is run that you save the out put as a text file, it makes it easier to read and action. 
From this detail articles like the ones called out as well as others many will require you to login the knowledge base to review them offer ways of reducing, removing, truncating the tables to reduce size.

For example this one may prove to be helpful 'if' the dB size is deemed to be large.

How to identify why the ePolicy Orchestrator database is very large
Technical Articles ID: KB76720

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 5 of 11

Re: ePO performance issue

Jump to solution

KB66797 that you were given has a reindex script attached to it.  I would suggest turning off all epo services and agent handlers, run that script, then see if issue improves.  Also, have you recently deployed the 5.6.0.878 version of the McAfee agent?  If so, check kb91418.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: ePO performance issue

Jump to solution

yes I was upgraded my MA to 5.6, however when I check on the log mentioned on kb91418, I didn't find any of event.Critical: Failed in ma_db_transaction_begin, error = 217.

So I believed mine is not the case?

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 7 of 11

Re: ePO performance issue

Jump to solution

If you aren't running the 5.6.0.878 version of the agent, you won't have the issue in kb91418.  If you do have that version deployed, then not every system will exhibit that behavior.  It only takes one or 2 sending millions of events a day to cause some epo console slowness and other issues.  Verify you don't have any of that build of agent deployed before ruling out that issue.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: ePO performance issue

Jump to solution

Too bad i have thousand of machines running with this version 

Re: ePO performance issue

Jump to solution

Thanks for your suggestion, below is the message that i gotten from running the script:


Script name : ePO_Database_Summary_4x5x_v4.2.sql
Report run at : 02 May 2019 10:40:41:640


SQL Server information:
=======================
SQL Server version : SQL Server 2016 SP2 Standard Edition (64-bit)
SQL Server memory (MB) : 65535


ePO information:
================
ePO Server version : 5.10.0
ePO Database name : ePO_epo
Event database name : ePO_epo_Events


Collation information:
======================
Server collation : SQL_Latin1_General_CP1_CI_AS
TempDB collation : SQL_Latin1_General_CP1_CI_AS
ePO DB collation : SQL_Latin1_General_CP1_CI_AS
Event DB collation : SQL_Latin1_General_CP1_CI_AS


ePO Database file information:
==============================
Logical file name File Size(MB) Physical file name
---------------------------------------------------------------------------------------------------------------------

ePO_epo 58971 E:\MSSQL\Data\ePO_epo.mdf
ePO_epo_lo 60488 F:\MSSQL\Log\ePO_epo_log.ldf


Events Database file information:
=================================
Logical file name File Size(MB) Physical file name
---------------------------------------------------------------------------------------------------------------------

ePO_epo_Events 8 E:\MSSQL\Data\ePO_epo_Events.mdf
ePO_epo_Events_log 520 F:\MSSQL\Log\ePO_epo_Events_log.ldf
ePO_epo_Events_CatchAll 1024 E:\MSSQL\Data\ePO_epo_Events_CatchAll.NDF


ePO Database table information - top 10 tables by size
======================================================
Database Name Table Name Row Count Total Space (KB) Data Space (KB) Index Space (KB) Unused Space (KB)
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
ePO_epo EPOProductEventsMT 94523322 53996288 25431904 28564384 11064
ePO_epo OrionSnapshot 159 4096528 4096464 64 456
ePO_epo OrionLastRunReportMT 43 562176 562168 8 664
ePO_epo EPOLeafNodeUser_TreeAssignmentIDsMT 4786545 368520 175664 192856 2672
ePO_epo OrionSchedulerTaskLogDetail 438486 341120 311928 29192 304
ePO_epo EPOProductSettingValuesMT 677109 112672 37928 74744 3120
ePO_epo EPOLeafNodeUser_TreeAssignmentsMT 230735 77528 68408 9120 160
ePO_epo SCOR_BINARY_REPUTATION 86387 58936 49232 9704 240
ePO_epo SCOR_EVENTS 24510 57744 31456 26288 520
ePO_epo EPOPolicySettingValuesMT 127383 51088 18736 32352 1168

Number of rows in EPOComputerPropsStaging table : 19


Events Database table information - top 10 tables by size
=========================================================
Database Name Table Name Row Count Total Space (KB) Data Space (KB) Index Space (KB) Unused Space (KB)
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
ePO_epo_Events EPOEvents 68073 118336 47416 70920 40056



Machine counts:
===============
ePOBranchNode entries (number of sites / groups) : 25
ePOLeafNode entries (number of machines) : 3757
Machines whose last update was over 1 month ago : 72
Duplicate machines (with same name) : 0


Threat Event information:
=========================
Total events : 68073
Oldest event : Feb 1 2019 1:02AM
Newest legal event (not in the future) : May 2 2019 12:17AM
Number of "illegal" events (date in the future) : 2


Top 5 most common threat events, by count descending
====================================================
Event ID Count Event Description
--------------------------------------------------
20719 24007 File Write Denied
1119 17591 The update failed; see event log
1092 17373 Access Protection rule violation detected and blocked
36635 3325 Update successful
18060 1276 Exploit Prevention Files/Process/Registry violation detected


Product event information:
==========================
Total product events : 94523877
Oldest product event : Sep 30 2002 10:21AM
Newest legal product event : May 2 2019 12:38AM
Number of "illegal" product events (date in the future) : 67


Top 5 most common product events, by count descending
=====================================================
Event ID Count Event Description
--------------------------------------------------
2401 46299645 Update Successful
2402 19512932 Update Failed
2422 17764886 Agent failed to enforce policy on at least one point product
2427 10927558 Agent failed to collect properties from at least one point product
2411 9128 Deployment Successful

 

 

Not sure what to be change to get rid of my issue?

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 10 of 11

Re: ePO performance issue

Jump to solution

To start with, you must get off that .878 build of the agent - it has been pulled from the download site because of this issue.  That is not an option, it is absolutely necessary. You can either do a forceinstall of the 5.6.0.702 version, or call into support and get the hotfix version that fixes this and set up a deployment task.  If you don't, your database can get flooded with millions of events, cause drive space issues, server busy handling them all, possible deadlocks and other symptoms. 

Once you do that, support also has a script to remove the duplicate events that are being sent by that agent version.  As long as you have even one agent with that build, you have the potential for the event flooding. 

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community