cancel
Showing results for 
Search instead for 
Did you mean: 
mcdave
Level 10
Report Inappropriate Content
Message 1 of 6

epo 4.5 agent handler & diskspace usage

Hi

I noticed that one of our agent handlers ran out of diskspace.

So i had a look at it ans saw that the directory "..\Agent Handler\DB\Events" has grown over 24GB?

I dont think this is normal, the directory is filled with PKG files.
What can be the cause of this enormous growth and what can I do to reduce it?

regards

Dave

5 Replies
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: epo 4.5 agent handler & diskspace usage

The events folder is used for storing events before they are passed to the db, so that would imply there's a problem with the event parser. Is the event parser service running on the agent handler? Are there any errors in the event parser log?

Regards -

Joe

mcdave
Level 10
Report Inappropriate Content
Message 3 of 6

Re: epo 4.5 agent handler & diskspace usage

the eventparserlog is indeed full of errors:

20100207042448    E    #3220    DAL         DAL2_CConnection::GetConnection: giving up retrying connection.
20100207042448    E    #3220    DAL         CConxIndex::~CConxIndex(): hr=0x80004003,
20100207042548    I    #3220    EVNTPRSR    Trying to re-establish a connection with the database.
20100207042548    E    #3220    DAL         Meaning = Unspecified error
20100208141756    I    #3220    EVNTPRSR    Trying to re-establish a connection with the database.
20100208141800    E    #3220    DAL         COM Error :80004005 in DAL2_CConnection::GetConnection
20100208141800    E    #3220    DAL         Meaning = Unspecified error
20100208141801    E    #3220    DAL         Source = Microsoft OLE DB Provider for ODBC Drivers
20100208141801    E    #3220    DAL         Description = [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
20100208141805    E    #3220    DAL         COM Error :80004005 in DAL2_CConnection::GetConnection
20100208141806    E    #3220    DAL         Meaning = Unspecified error
20100208141806    E    #3220    DAL         Source = Microsoft OLE DB Provider for ODBC Drivers
20100208141807    E    #3220    DAL         Description = [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
20100208141811    E    #3220    DAL         COM Error :80004005 in DAL2_CConnection::GetConnection
20100208141812    E    #3220    DAL         Meaning = Unspecified error
20100208141813    E    #3220    DAL         Source = Microsoft OLE DB Provider for ODBC Drivers
20100208141814    E    #3220    DAL         Description = [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
20100208141817    E    #3220    DAL         DAL2_CConnection::GetConnection: giving up retrying connection.
20100208141817    E    #3220    DAL         CConxIndex::~CConxIndex(): hr=0x80004003,
20100208141918    I    #3220    EVNTPRSR    Trying to re-establish a connection with the database.
20100208141921    E    #3220    DAL         COM Error :80004005 in DAL2_CConnection::GetConnection

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: epo 4.5 agent handler & diskspace usage

Sounds like the AH can't see the database... check the db.properties file in the DB folder. This file tells the AH how to find the database.

Can you access the db (db.database.name) on the SQL server (db.server.name) using the account specified?

Regards -

Joe

mcdave
Level 10
Report Inappropriate Content
Message 5 of 6

Re: epo 4.5 agent handler & diskspace usage

I've reregistered "sqloledb.dll" and copied "db.properties" from another Agent handler.

And the eventparser logfile looks like this now.
Is this OK? Because I don't see a lot of diskpace getting freed up?

It stays at 1GB of free HDD space for over an hour now.

20100208185706    E    #6080    EVNTPRSR    server_LookForBLLExtension: No plugin available for <SnowCapSensorEvents>
20100208185706    E    #3920    EVNTPRSR    server_LookForBLLExtension: No plugin available for <SnowCapSensorEvents>
20100208185706    E    #3964    EVNTPRSR    server_LookForBLLExtension: No plugin available for <SnowCapSensorEvents>
20100208185706    E    #2572    EVNTPRSR    server_LookForBLLExtension: No plugin available for <SnowCapSensorEvents>
20100208185706    E    #3872    EVNTPRSR    server_LookForBLLExtension: No plugin available for <SnowCapSensorEvents>
20100208185706    E    #3864    EVNTPRSR    server_LookForBLLExtension: No plugin available for <SnowCapSensorEvents>
20100208185706    I    #3148    EVNTPRSR    Process C:\Program Files\McAfee\Agent Handler\DB\Events\z000511395a7-9f8d-4860-afe0-d9899fc7a445-2009122823074867191590000084C.xml succeeded (IEPOEventHandler)
20100208185706    I    #6104    EVNTPRSR    Process C:\Program Files\McAfee\Agent Handler\DB\Events\z000511f83a0-01c5-4c64-a82c-dfdea8a3baca-2010012715010350084750000161C.xml succeeded (IEPOEventHandler)
20100208185706    I    #6040    EVNTPRSR    Process C:\Program Files\McAfee\Agent Handler\DB\Events\z0005120fad7-4bd9-471f-b07d-a877f7f36450-20100125220442375376800001464.xml succeeded (IEPOEventHandler)
20100208185706    I    #2476    EVNTPRSR    Process C:\Program Files\McAfee\Agent Handler\DB\Events\z00051111551-f80c-4fdc-a92e-addea3e37b9b-20091211144116241052600001424.xml succeeded (IEPOEventHandler)

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: epo 4.5 agent handler & diskspace usage

Okay, still some errors, but some events are now being processed at least.

A backlog of that size is going to take some time to clear - I would suggest you simply monitor it and see if the number of event files reduces over time. If you wish you can stop the ePO 4.5 Server service on the agent handler but leave the event parser running - that will prevent new events from coming in while the backlog clears.

Regards -

Joe