1 2 Previous Next 10 Replies Latest reply on Apr 29, 2009 12:58 PM by epo909

    Failed to purge the Event Log

    SergeM
      Hi,

      My event logs are "huge" (or was it humugus?)
      So I wanted to remove all 1095 ("access protection violation" >20 million events) from the logs.

      Created a report to show these and used the query in a purge... done it before.

      This time (tried 5 times) wait for +20 minutes and then...

      Failed to purge the Event Log. Check the ePO logs for more information.


      so... *curse* I decide to purge all events that are more than 3 months old...

      Guess what the result was ... same error message.

      Ideas anyone ?

      thanks in advance
      Serge
        • 1. RE: Failed to purge the Event Log
          What is the size of your ePO database? I know there is a problem when the ePO database is very large, that this events come.

          A solution could be to contact Mcafee support and ask for a SQL query that would delete the old events.Try to open a case and mention this error. They will send you the sql query.
          • 2. RE: Failed to purge the Event Log
            I think I can recall that I had some problem with purging events, it was fixed with one of the patches.
            If you are not running ePO 4, then I don't know, but if you are stick patch 4 on.
            • 3. RE: Failed to purge the Event Log
              also, I had this same issue, with that stupid 1059 event being reported all the time.

              There is an option so that you can actually disable this event from being reported to the ePO server.
              You can just untick that event from the list of reported events.

              I did that already, but I think it might still be getting reported anyway, so I need to check this.

              Anyone else seen that?
              • 4. RE: Failed to purge the Event Log
                SergeM


                DB size (mdf file) is 34 GB, which is why I want to purge it in the first place :(

                I know it's too large (at least for my taste) - and I only have about 1/3 of the expected final number of users :(

                IT seems ridiculous that one can't purge the DB with the provided tools...

                Thanks for the answer(s) tho
                Serge
                • 5. RE: Failed to purge the Event Log
                  SergeM


                  Unticking it only affects the future... I'm stuck with a bloated DB and need to purge it before it eats the entire disk. :mad:

                  Besides, I already unticked several logs in VSE "Access Protection Policy" after I identified that the events came from VSE's APP. An old problem, whant to log and what not to log... when is it enough or too much, or missing :confused:

                  Thanks for the answer(s) tho
                  Serge :cool:
                  • 6. RE: Failed to purge the Event Log
                    Hi,

                    Did you notice my first post?

                    I am pretty sure I had the same issue when running patch 2, you need to upgrade to patch 4.
                    • 7. RE: Failed to purge the Event Log
                      SergeM


                      Hi and thanks for your answer,

                      Yes I did notice your post, I wanted to reply and then I slipped in a different time stream and am only now coming back :cool:

                      I find I don't know how to check which version/patch of ePO I'm using... I'm fairly certain I did apply patch 4 recently (like this month) but I can't figure out how to know where I stand...

                      Another thing I noticed some time ago, in the main Dashboard screen, there's one dashboard called "Master Repository Status". I've seen with other admins on this forum that there was a green information line. On my server, I have a grey line saying "No Information Available". It's been like this ever since we installed the server and I didn't know enough to wonder what that'd mean :o

                      Serge
                      • 8. RE: Failed to purge the Event Log
                        Hi, oh, if you have already installed patch 4 then thats the only idea I had, I certainly did have an issue purging with patch 2, and patch 3 fixed it, but I am running patch 4 now (that fix would be included anyway).

                        If you go to your ePO console if you are running Patch 4 it will say

                        ePolicy Orchestrator 4.0.0 (Build 1221)

                        If it's any less than build 1221 then you are not running Patch 4.
                        1 2 Previous Next