5 Replies Latest reply on Feb 9, 2010 5:09 AM by JoeBidgood

    epo 4.5 agent handler & diskspace usage

    mcdave

      Hi

       

      I noticed that one of our agent handlers ran out of diskspace.

      So i had a look at it ans saw that the directory "..\Agent Handler\DB\Events" has grown over 24GB?

       

      I dont think this is normal, the directory is filled with PKG files.
      What can be the cause of this enormous growth and what can I do to reduce it?

       

      regards

      Dave

        • 1. Re: epo 4.5 agent handler & diskspace usage
          JoeBidgood

          The events folder is used for storing events before they are passed to the db, so that would imply there's a problem with the event parser. Is the event parser service running on the agent handler? Are there any errors in the event parser log?

           

          Regards -

           

          Joe

          • 2. Re: epo 4.5 agent handler & diskspace usage
            mcdave

            the eventparserlog is indeed full of errors:

             

            20100207042448    E    #3220    DAL         DAL2_CConnection::GetConnection: giving up retrying connection.
            20100207042448    E    #3220    DAL         CConxIndex::~CConxIndex(): hr=0x80004003,
            20100207042548    I    #3220    EVNTPRSR    Trying to re-establish a connection with the database.
            20100207042548    E    #3220    DAL         Meaning = Unspecified error
            20100208141756    I    #3220    EVNTPRSR    Trying to re-establish a connection with the database.
            20100208141800    E    #3220    DAL         COM Error :80004005 in DAL2_CConnection::GetConnection
            20100208141800    E    #3220    DAL         Meaning = Unspecified error
            20100208141801    E    #3220    DAL         Source = Microsoft OLE DB Provider for ODBC Drivers
            20100208141801    E    #3220    DAL         Description = [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
            20100208141805    E    #3220    DAL         COM Error :80004005 in DAL2_CConnection::GetConnection
            20100208141806    E    #3220    DAL         Meaning = Unspecified error
            20100208141806    E    #3220    DAL         Source = Microsoft OLE DB Provider for ODBC Drivers
            20100208141807    E    #3220    DAL         Description = [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
            20100208141811    E    #3220    DAL         COM Error :80004005 in DAL2_CConnection::GetConnection
            20100208141812    E    #3220    DAL         Meaning = Unspecified error
            20100208141813    E    #3220    DAL         Source = Microsoft OLE DB Provider for ODBC Drivers
            20100208141814    E    #3220    DAL         Description = [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified
            20100208141817    E    #3220    DAL         DAL2_CConnection::GetConnection: giving up retrying connection.
            20100208141817    E    #3220    DAL         CConxIndex::~CConxIndex(): hr=0x80004003,
            20100208141918    I    #3220    EVNTPRSR    Trying to re-establish a connection with the database.
            20100208141921    E    #3220    DAL         COM Error :80004005 in DAL2_CConnection::GetConnection

            • 3. Re: epo 4.5 agent handler & diskspace usage
              JoeBidgood

              Sounds like the AH can't see the database... check the db.properties file in the DB folder. This file tells the AH how to find the database.

               

              Can you access the db (db.database.name) on the SQL server (db.server.name) using the account specified?

               

              Regards -

               

              Joe

              1 of 1 people found this helpful
              • 4. Re: epo 4.5 agent handler & diskspace usage
                mcdave

                I've reregistered "sqloledb.dll" and copied "db.properties" from another Agent handler.

                 

                And the eventparser logfile looks like this now.
                Is this OK? Because I don't see a lot of diskpace getting freed up?

                It stays at 1GB of free HDD space for over an hour now.

                 

                 

                 

                20100208185706    E    #6080    EVNTPRSR    server_LookForBLLExtension: No plugin available for <SnowCapSensorEvents>
                20100208185706    E    #3920    EVNTPRSR    server_LookForBLLExtension: No plugin available for <SnowCapSensorEvents>
                20100208185706    E    #3964    EVNTPRSR    server_LookForBLLExtension: No plugin available for <SnowCapSensorEvents>
                20100208185706    E    #2572    EVNTPRSR    server_LookForBLLExtension: No plugin available for <SnowCapSensorEvents>
                20100208185706    E    #3872    EVNTPRSR    server_LookForBLLExtension: No plugin available for <SnowCapSensorEvents>
                20100208185706    E    #3864    EVNTPRSR    server_LookForBLLExtension: No plugin available for <SnowCapSensorEvents>
                20100208185706    I    #3148    EVNTPRSR    Process C:\Program Files\McAfee\Agent Handler\DB\Events\z000511395a7-9f8d-4860-afe0-d9899fc7a445-20091228230748671915 90000084C.xml succeeded (IEPOEventHandler)
                20100208185706    I    #6104    EVNTPRSR    Process C:\Program Files\McAfee\Agent Handler\DB\Events\z000511f83a0-01c5-4c64-a82c-dfdea8a3baca-20100127150103500847 50000161C.xml succeeded (IEPOEventHandler)
                20100208185706    I    #6040    EVNTPRSR    Process C:\Program Files\McAfee\Agent Handler\DB\Events\z0005120fad7-4bd9-471f-b07d-a877f7f36450-20100125220442375376 800001464.xml succeeded (IEPOEventHandler)
                20100208185706    I    #2476    EVNTPRSR    Process C:\Program Files\McAfee\Agent Handler\DB\Events\z00051111551-f80c-4fdc-a92e-addea3e37b9b-20091211144116241052 600001424.xml succeeded (IEPOEventHandler)

                • 5. Re: epo 4.5 agent handler & diskspace usage
                  JoeBidgood

                  Okay, still some errors, but some events are now being processed at least.

                  A backlog of that size is going to take some time to clear - I would suggest you simply monitor it and see if the number of event files reduces over time. If you wish you can stop the ePO 4.5 Server service on the agent handler but leave the event parser running - that will prevent new events from coming in while the backlog clears.

                   

                  Regards -

                   

                  Joe