1 of 1 people found this helpful
Hi yoann63, it depends on how many events are triggered by your computers and how long you want to store this events (15 days, 1 month, 6 months...)
With SQL Express 2008 you'll have up to 10Gb space that I think is more than enough for 1.000 computers. I have some ePO servers that are managing 800 computers with SQL Express 2005 (up to 4Gb) without problems
i see on the first installation page that EPO propose me only sql server express 2005 (not express 2008).
So i suppose that i have to set it up manually before EPO, that's right ?
That's right, at this moment ePO 4.6 still doesn't ship with SQL Express 2008 so you will have to set it up yourself before installing ePO
Hi Yoann63. As a professional Security engineer who installs and maintains ePO for a living, we would recommend SQL Express for up to 2000 users - although you can use more as long as you use optimisation - ie regular database maintenance (ie event purging).
In a corporate environment we would always recommend using an clustered SQL environment with a virtual ePO server - to be honest with ePO it really doesnt matter if it's 2005 or 2008 - although with 4.6 you have to use 2005 SP3 regardless of it's Express or full. This is the perfect scenario given expandability and disaster recovery considerations.
It also greatly depends on which products your are using within ePO.
E.g. when using Policy Auditor the database size can get quite huge in a short time depending how many results you store (about 1 MB per scan result and client afaik).
Also regarding VSE events the Access Protection rules should be carefully evaluated when using a restricted SQL Express Edition. They can also be created in great amounts (once saw one single machine generating 8 GB of AP events in four weeks) ...
Generally with Express Edition you have to keep an eye on the database size because ePO itself is not "aware" of the size restriction and getting into real problems when reaching the limit. There are sample dashboards available to keep an eye on the events : https://community.mcafee.com/docs/DOC-3929
Also SQL Express misses the option to create the needed maintenance tasks via the GUI (SQL management studio). So you´ll have to script everything on your own.
We have been using SQL Express 2005 under ePO 4.6 with no issues. Currently we have about 2100 clients and don't see issue. On a weekly basis, I purge the database of events older than 6 months. Our database usually sits at around 200MB which is good. Would recommend that install the dashboard called -EPO Database Growth which you can get form this forum. It will show you the top number of events. This helped me generate purge tasks that target specific event id's. In our environment, we just monitor the virus software and don't have additional products like siteadvisor, DLP etc. If we were to install these products then we would consider moving to a full version of SQL. We recently moved from ePO 4.0 with MSDE to ePO 4.6 with SQL Express 2005.