4 Replies Latest reply on Jun 3, 2010 4:48 AM by ErinC

    Purge ePO4.5 database problem

      Hi All,

       

      Hopefully someone can advise on this.  I see other people have had similar problems with massive ePO databases.

      Our database is very large.  We've changed the filtering options and just want to remove the contents and start again, we don't mind losing the lot that's there, it'll rebuild itself.

       

      Our database administrator has tried to truncate the DB and has asked me to post the following here;

       

      truncate table dbo.EPOEvents

       

      Msg 4712, Level 16, State 1, Line 1
      Cannot truncate table 'dbo.EPOEvents' because it is being referenced by a FOREIGN KEY constraint.

       

      Can anyone comment as to why he has got this error ?  Or can someone suggest a better way of clearing out the DB ?

      I've pointed him at some McAfee KB articles (they were for ePO4 though) and he's had no luck so far.

       

      Thanks!

        • 1. Re: Purge ePO4.5 database problem
          jgriffin

          ErinC,

           

          I'm guessing that your ePOEvents table is the one that is rather large, is that correct? If so, take a look at the following KB articles in the system for assistance on purging that table. NOTE: The article is specific to ePO 4.0 but it also should work for ePO 4.5 too. The ePO service names piece is really the only thing different there. This process can be done for other larger tables too.

           

          The article in question is KB51873.

           

          I would recommend to skip step #6 in KB51873 and refer to the section titled "Shrink Database and why it is NOT recommended:" in KB67184 as to the reason for skipping that step.

           

          HTH

          John

           

           

          Message was edited by: John Griffin on 5/25/10 4:59:10 PM CDT
          • 2. Re: Purge ePO4.5 database problem

            John, thank you for the information and for your time.  We had already read the first KB article you linked to and I've suggested to our DBA that we use the OSQL commands as recommended.

             

            According to the second linked KB article it seems that the main reason not to shrink the database doesn't really apply if you're deleting massive amounts of data like we propose to do.  I'll post back our solution once we've looked at this some more.

             

             

            edit: typo

             

             

            Message was edited by: ErinC on 26/05/10 03:59:10 CDT
            • 3. Re: Purge ePO4.5 database problem
              JoeBidgood

              Hi...

               

              You can't use the TRUNCATE command on the ePOevents table because there are constraints on it. You could either drop the constraints, truncate the table, and then recreate the constraints, which would be the preferred approach if the table was truly enormous: alternatively, you can simply do "DELETE FROM ePOevents" which will take longer, but will have the same effect and will work within the constraints. (Note that this option will cause the transaction log to grow during the course of the delete, but it will correct itself when the process is over.)

               

              Whichever you choose, both of these procedures should be performed with the ePO services stopped.

               

              HTH -

               

              Joe

              1 of 1 people found this helpful
              • 4. Re: Purge ePO4.5 database problem

                Just an update to close this thread;

                 

                We finally just ran numerous Purge Threat Event tasks from the ePO console's Server Tasks, doing older than 12 months, then another older than 11 months and so on until it was cleared right down.  The purges took a long time to run but we've cleared the database down to a manageable level again and confirmed that the adjusted filtering is doing as intended.  The database is growing at a much more reasonable level now and I've configured scheduled purges to run daily that removes anything over 6 months old.

                 

                Thanks again Joe