7 Replies Latest reply on Mar 11, 2010 12:09 PM by jstanley

    ePO 4.5 Database size issue

      Hello everyone.

       

      I am puzzled with something. I have a ePO 4.5 database that uses SQL Express, so the limit of the Database is 4GB.

       

      I reached that limit, and had to do a purge.

       

      The drive size had 20GB free before the purge, now it has 10GB free AFTER the purge!

       

      How can a purge suck up 10GB of space?

       

      Am I missing something here?

       

      As a side note, ePO is taking up a total of 50GB on my drive AFTER a database purge of all events before 12-20-09. This is crazy!

       

      Thanks for any help.

        • 1. Re: ePO 4.5 Database size issue
          jstanley

          This is the way SQL works. Purging information from a SQL DB will actually cause the DB size to grow because every single item that was deleted is logged in the SQL transaction log. Also even though the information has been removed from the DB the DB files still have the space reserved on the file system.

           

          Here are the high level steps to successfully reduce your ePO DB size:

          1- Stop the ePO services

          2- Backup the ePO DB

          3- Purge the data from the DB if you have not already done this via tasks in the ePO GUI. If you have don't worry you have not broken anything just continue to the next step.

          4- Shrink the DB

          5- Start the EPO services.

           

          It is not required that you stop the ePO services when baking up/shrinking the DB it will just cause these tasks to complete faster.

           

          Here is a KB that covers how to do these steps in OSQL incase you don't have the SQL management tools installed (KB51873):

          https://kc.mcafee.com/corporate/index?page=content&id=KB51873

          • 2. Re: ePO 4.5 Database size issue

            Thanks Jeremy, that helped quite a bit.

             

            I am suprised how much crap this thing collects and has to deal with. I'm trying to find a way to make it so ePO doesn't have to bloat the crap out of the DB. I'm obviously a newbie at this, but I have a quad core system with all 4 cores pegged at 80-90% non-stop for 450 systems. This doesn't make any sense to me and the Mcshield.exe sucks up 40% non-stop as well. I'm thinking I have something misconfigured.

             

            Thanks again for your help. Still learning!

            • 3. Re: ePO 4.5 Database size issue
              jstanley

              If you want to determine why the DB is filling up so quickly you may want to run through KB52116:

              https://kc.mcafee.com/corporate/index?page=content&id=KB52116

               

              By far the most common reason for this is eventIDs 1051 and 1059. These events are generated by VSE extremely frequently and they are not really an indication of any threat. You can see the event description and also filter those events out in the ePO console. This will prevent clients from forwarding the events to ePO so they won't be written to the DB (it will not remove the events that have already been written to the DB). Here is how:

              1. Logon to the ePO console
              2. Click Configuration | Server Settings | Event Filtering | Edit
              3. Locate any event you do not want forwarded to EPO and deselect it
              4. Click Save

               

              I hope that helps!

              • 4. Re: ePO 4.5 Database size issue
                jstanley

                O btw for the mcshield thing you may want to ping the VSE community but if its installed on your SQL server it is probably scanning the SQL DB files as they are being updated. Just go into the exclusions and tell it to exclude by file type all .MDF and .LDF files.

                • 5. Re: ePO 4.5 Database size issue

                  Thank you! That is great information.

                  • 6. Re: ePO 4.5 Database size issue

                    Jeremy, how do I perform Step 3 from the ePO GUI?  Our .MDF is up around 25 gigabytes and we'd like to reduce the size of it.  I was handed responsibility for ePO at the first of the year and don't know squat about SQL.

                     

                    Thanks.

                    • 7. Re: ePO 4.5 Database size issue
                      jstanley

                      The easiest method would be to just run the script in step 5 of KB51873:

                      https://kc.mcafee.com/corporate/index?page=content&id=KB51873

                       

                      You don't have to use OSQL you can use those same SQL commands in query analyzer if you have the full SQL management tools. Keep in mind you MUST do some of these steps in SQL. You can purge the events through ePO but that will actually result in making the DB larger not smaller. The combination of DB backup/events purge/DB shrink will reduce the DB size (all 3 steps are required, don't skip the backup).

                       

                      To setup an events purge task in EPO 4.0:

                      1. Logon to ePO
                      2. Click Automation
                      3. Click New Task
                      4. Name the task and click Next
                      5. Select Purge Event Log for the task type
                      6. Specify how far back you wish to purge the event (events older than X days)
                      7. Click Next
                      8. Schedule the task
                      9. Click Next | Save

                       

                      I hope that helps!