4 Replies Latest reply on Jan 21, 2010 9:22 AM by techie

    EPO database drive transfer

      I ran into a problem when moving my SQL database for EPO between two drives on the same server. EPO appears to be working fine when logged into the console, and the Threat Event Log is still recording events. However when I look at the actual database file itself, it is not changing in size at all nor is the modified date changing what-so-ever. It seems as though McAfee is writing the events to some database/log file that I can not find and not to the actual database. Below is my current configuration and process that was used to move the database:


      Windows Server 2k3 SP2 x86

      2x36GB drives

      EPO 4.5

      SQL 2005


      Backup EPO Database

      Stop McAfee services

      Detach EPO Database within SQL

      Copy Database file

      Attach copied Database

      Start McAfee services

        • 1. Re: EPO database drive transfer

          Hmmm... certainly sounds a bit strange

          Everything you've done sounds fine. I would check the db that ePO is using in the core/config page, and assuming it's the db that you moved then that should be fine.

          You can always test it, albeit slightly crudely, by stopping the ePO services, detaching the db in question, and then starting the services again. If you get a load of errors in the orion log and can't log in to epo, then you know you've got the right db


          Regards -



          1 of 1 people found this helpful
          • 2. Re: EPO database drive transfer

            Thanks Joe, I tried your procedure and it responded just like you said. I received multiple errors on the EPO logon screen after detaching the DB and was unable to logon. Upon re-attaching the DB and re-starting all services, I was able to logon to EPO no problem. Thats a big relief, but I am still puzzled as to why the Modify date on the EPO DB isn't changing. I am under the impression that the DB modify date changes anytime something within the DB changes, such as recording a new event. This means the the DB should be changing constantly. Is this correct?


            Like I said before everything appears to be working properly, its just this date that is worrying me. Perhaps I am overthinking this...

            • 3. Re: EPO database drive transfer

              At least we know you've got the right db

              Which file are you talking about? The .mdf file?



              • 4. Re: EPO database drive transfer

                Both the .mdf (Database) and .ldf (transaction log).