3 Replies Latest reply on Jan 30, 2012 11:48 AM by syd

    Excessive Events (18000 & 180002)


      I have several sites that I have started to monitor and found that their EPO databases have grown quite large (90 and 230 Gig). I have followed several previsous McAfee discussions regarding this and performed queries to retreive the top 10 events stored in the EPOEvents. One site had over 67 million event ID 18002, while another had over 100 million, with both having the 18000 a close second in numbers. Since starting the monitoring I have performed event filtering to exclude these two events while I attempt to delete these events from the database. I'm curious about several things. Is this normal? The larger site has over 900 clients while ther smaller site has 500. One site filled up a disc partition completely, effectively killing EPO until I could shrink and move the transaction log to another partition. My process for cleaning up the databases now is running the sql command I found in a previous discussion which deletes all events older than a selected date in increments of 5000. This is slowly (and I emphasize slowly) removing the older events. Is there a better/quicker/more effective way to perform this? My end goal is to get the database down to a sane size and then ensure that purging is taking place on a weekly interval to delete events older than 6 months to prevent this from happening again. Are there any experts that have an opinion on this?


      My platforms are: Server 2008R2, Sql Server 2008SP1, EpO 4.5P3, HIPS 7.0.0


      Thank you


        • 1. Re: Excessive Events (18000 & 180002)

          Why delete older events in blocks of 5000?


          As long as the DB server can handle it (transactional log sizes/disk space etc..) why not increase it to 50,000 or 500,000?

          • 2. Re: Excessive Events (18000 & 180002)

            I suppose ignorance is the main reason why. I'm by no means a SQL expert. For the system that filled up a partition previously, I shrank the transaction log prior to deletions and had it down to under a Gig. After starting the event deletions though, it has grown back up to 12 Gig. I'll try to increment it up per your suggestion and see how that works. Thanks for your suggestion Tristan! My newness to this is really showing so I did want some other eyes on the situation to give me a 'sanity check' of what I'm doing to clean up the databases.


            • 3. Re: Excessive Events (18000 & 180002)

              This is an update.

              I have shrunk the databases and added all the 'purge' tasks I could find to keep this from happening again. The number of events has dropped but the larger site (after four days) has only dropped from a previous high of over 180 million events (Event ID 18002) to 95 million. This is a slow process. I'm still curious as to the number of 18002 events though. Has anyone else experienced this?