Am trying to reduce my ePO DB somewhat, so have gone to threat events and tried to delete, managed to get rid of some but now I'm stuck as I get 'Failed to delete the events. Check the ePO logs for more information' when trying to delete and there are still 10's of thousands of events there. Where do I find 'ePO logs'? Anyone else had this before?
Would really like to avoid running a SQL query if possible.
I'm on ePO 4.6.5 (Build: 168), using VSE 8.8 Patch 2 on Windows 2008 R2 Standard.
Hope someone can help.
The first place to look is in the orion log, which is in <epo install folder>\Server\Logs by default. However this can be quite a noisy log, so try to delete the events again and as soon as you get the error, check the log for errors.
They can be pretty cryptic so feel free to attach the log here if you wish.
apart from this, thinking out of the box here,
can you check the size of your events at this Location?
C:\Program Files\McAfee\ePolicy Orchestrator\DB\Events
This folder is used as a temporary working area for the event parser - events are received by the ePO server service and placed into this folder, where the event parser picks them up. Any events in here have not yet been processed into the DB, so they will not be affected by the purge task mentioned by the original poster.
Generally speaking, it's normal for there to be a small backlog of events in this folder waiting to be processed: but itf the number is very large, it may mean there's a problem with the event parser.
Yes, JoeBidgod, you are right, I just wanted to confirm how large size this folder is,we can delet them before processing to let event parser work, if there is huge file size.
Thanks for replies, tried deleting the events again this morning and voila, away they went! Can't explain, sorry!