5 Replies Latest reply on Jul 22, 2010 5:45 AM by mcafeedubai

    DB\events folder eating up space

      Hi,

       

      Environment - windows Server 2003 r2(Virtual Machine), ePO 4.5, SQL 2005 on cluster

       

      In the epo install folder \DB\events, there are over 1 million .xml and .pkg files which is eating up all the disk space on the server. Below is a copy sample of the event parser log file which continuously generates the same error. Can anyone help.

       

       

       

      20100407091603    E    #2928    EVNTPRSR    server_ProcessXMLFile: COM Error :80004005 server_ProcessXMLFile
      20100407091603    E    #2928    EVNTPRSR    Meaning = Unspecified error
      20100407091603    E    #2928    EVNTPRSR    Source = (null)
      20100407091603    E    #2928    EVNTPRSR    Description = (null)
      20100407091603    I    #2948    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002dedaeca-f204-437e-a0db-18402773d796-2010040606514 9697787600000790.xml succeeded (IEPOBllExt)
      20100407091603    I    #2908    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002e3ebf17-8889-4083-b76f-b0b289d6d3eb-2010040700251 4775936100000658.xml succeeded (IEPOBllExt)
      20100407091604    I    #2936    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002ed788b5-46dc-458b-a199-fbfb83fa9d43-2010040618500 2671425000000EC4.xml succeeded (IEPOBllExt)
      20100407091604    I    #2920    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002e172d9c-6cba-4cfa-8f38-7dcce0bc7a22-2010040302044 4822218300000790.xml succeeded (IEPOBllExt)
      20100407091604    I    #2960    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002e67d904-eab6-48ba-ae1a-790f255412aa-2010040514001 1665930100000790.xml succeeded (IEPOBllExt)
      20100407091604    E    #2928    NAEPODAL    CEPODAL::ExecQuery: COM Error(0x80040E07) Error converting data type varchar to uniqueidentifier.
      20100407091604    E    #2928    VseBll      DAL->ExecQuery failed. hr=80040e07
      20100407091604    E    #2928    EVNTPRSR    server_ProcessXMLFile: COM Error :80004005 server_ProcessXMLFile
      20100407091604    E    #2928    EVNTPRSR    Meaning = Unspecified error
      20100407091604    E    #2928    EVNTPRSR    Source = (null)
      20100407091604    E    #2928    EVNTPRSR    Description = (null)
      20100407091604    I    #2924    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002ef3d2f7-87e0-4608-a8c9-7be135db1e38-2010040700303 4939943100000C6C.txml succeeded (IEPOBllExt)
      20100407091604    I    #2944    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002dc4d91f-f2e6-4b4a-9282-a3fb64cb30be-2010040701190 468272280000084C.xml succeeded (IEPOBllExt)
      20100407091604    I    #2940    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002e54871b-2664-4121-8a18-81d27507d162-2010040320472 9103166700000790.xml succeeded (IEPOBllExt)
      20100407091604    I    #2916    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002dcdfd21-6110-41a0-8e9b-0dd322b59617-2010040617115 14849637000003CC.xml succeeded (IEPOBllExt)
      20100407091604    I    #2964    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002efa5847-f5d4-4c58-8671-9158ecbc23cf-2010040623260 0281576000001190.xml succeeded (IEPOBllExt)
      20100407091605    I    #2908    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002e3ebf17-8889-4083-b76f-b0b289d6d3eb-2010040700252 0275729200000658.xml succeeded (IEPOBllExt)
      20100407091605    I    #2948    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002dedaeca-f204-437e-a0db-18402773d796-2010040606515 5197677100000790.xml succeeded (IEPOBllExt)
      20100407091605    E    #2928    NAEPODAL    CEPODAL::ExecQuery: COM Error(0x80040E07) Error converting data type varchar to uniqueidentifier.
      20100407091605    E    #2928    VseBll      DAL->ExecQuery failed. hr=80040e07
      20100407091605    E    #2928    EVNTPRSR    server_ProcessXMLFile: COM Error :80004005 server_ProcessXMLFile
      20100407091605    E    #2928    EVNTPRSR    Meaning = Unspecified error
      20100407091605    E    #2928    EVNTPRSR    Source = (null)
      20100407091605    E    #2928    EVNTPRSR    Description = (null)

        • 1. Re: DB\events folder eating up space
          rackroyd

          The events queue is dynamic, but 1,000,000 in this folder seems excessive. These events are effectively unprocessed - you can delete them if you wish but you lose the associated data for reporting in doing so.

          The log snippet shows the event parser is working though, for example:

           

          20100407091604    I    #2920    EVNTPRSR    Process F:\DATA\EPO4.5\DB\Events\z0002e172d9c-6cba-4cfa-8f38-7dcce0bc7a22-2010040302044 4822218300000790.xml succeeded (IEPOBllExt)

          The error suggests that ePO does not understand something in these other event files:

           

          20100407091604    E    #2928    NAEPODAL    CEPODAL::ExecQuery: COM Error(0x80040E07) Error converting data type varchar to uniqueidentifier.
          20100407091604    E    #2928    VseBll      DAL->ExecQuery failed. hr=80040e07
          20100407091604    E    #2928    EVNTPRSR    server_ProcessXMLFile: COM Error :80004005 server_ProcessXMLFile
          20100407091604    E    #2928    EVNTPRSR    Meaning = Unspecified error
          20100407091604    E    #2928    EVNTPRSR    Source = (null)
          20100407091604    E    #2928    EVNTPRSR    Description = (null)

           

          VseBLL suggests these are from VirusScan. If you wish, find the oldest one in the list and open it up for review to see which component it has come from for sure.

          Otherwise make sure you are up to date with your VirusScan extensions in the ePO console, as this is where the event format is described

          .

          With so many events to process, it will take some time to clear and process and the ePO DB is going to grow somewhat. It may be simpler to back them off somewhere then reinsert to the events folder in smaller numbers.

          You should probably stop the ePO services while doing that.

           

          Rgds,

           

          Rob.

          • 2. Re: DB\events folder eating up space

            With over a million files in the events folder, windows doesnt even allow me to open it. It just hangs which would make moving them out the moving the back in extremely tedious. I have found some other posts where it was advised to reinstall the virusscanreports extention with the latest version. I stopped the Mcafee server and services and did this. Does stopping the event parser service make handling the DB\Events folder easier?

             

            Regards,

            Zain

            • 3. Re: DB\events folder eating up space
              rackroyd

              It'll stop any more events being added (but also stop any being processed through to the database).

               

              If you have just upgraded the reports extension you will need to keep the services running to keep ePO processing events.

              It's going to take quite a while to get through that many. Check the log to see if the error continues, then you will know if the extension has helped.

               

              Rgds,

               

              Rob.

              • 4. Re: DB\events folder eating up space

                After removing some of the files in the events folder, checked in the vse 8.7 and extention, the following error appears in the log continuously and there are no events that are 'successful'. I have logged a support call with Mcafee to see what they say.

                 

                20100408091646    E    #5164    NAEPODAL    CEPODAL::ExecQuery: COM Error(0x80040E07) Error converting data type varchar to uniqueidentifier.
                20100408091646    E    #5164    VseBll      DAL->ExecQuery failed. hr=80040e07
                20100408091646    E    #5164    EVNTPRSR    server_ProcessXMLFile: COM Error :80004005 server_ProcessXMLFile
                20100408091646    E    #5164    EVNTPRSR    Meaning = Unspecified error
                20100408091646    E    #5164    EVNTPRSR    Source = (null)
                20100408091646    E    #5164    EVNTPRSR    Description = (null)

                • 5. Re: DB\events folder eating up space

                  I am going through a similar issue,though my event logs are HDLP based.Have you been able to fix this issue.If so what was the resolution.

                   

                  Thanks