7 Replies Latest reply on Aug 11, 2008 10:50 AM by rict

    Purge doesn't Purge

      I'm using ePO v4 and I cannot get the purge action to delete anything from the database.

      I'll go to reporting, Host IPS, purge. I'll choose to purge anything older then 1 day and it will complete in about 1 - 2 seconds, but nothing will be deleted.

      Thoughts?
        • 1. RE: Purge doesn't Purge
          I have the same problem (ePO 4.0)

          I've tried to purge the DB both from the main Event Log screen of events older than 2 months, and from a Query screen of events matching some other specs, but neither has any effect on the events in the log...even though the "Action Taken" windows says the action was successfully completed...

          Anyone know what's going on here?

          rict
          • 2. RE: Purge doesn't Purge
            Just answered my own question:

            You have to logout, then log back in to have the changes to the database show up. Just flipping to other screens doesn't refresh the number of items and pages shown in the Reporting screen.

            That should be in the docs, but I don't see it anywhere.

            rict
            • 3. RE: Purge doesn't Purge
              Well, checking the McAfee Knowledgebase, I found some "osql" commands that are supposed to remove old events...but the "osql" command set is not recognized by the machine at all.

              Guess I'm just stuck with the entire 53859 items in the Event log; bummer!

              rict
              • 4. RE: Purge doesn't Purge
                metalhead
                Hmm, just a thought without having access to an epo database. Run the following statement:

                show * from EPOEvents

                Look at the date format of the DetectedUTC column.
                I would expect the date format to be YYYY/MM/DD (and not with dashes).
                • 5. RE: Purge doesn't Purge


                  Tom,

                  I'm not a DBA; do you mean that I should run this command from the command line on the ePO server? Or on the server that contains the database? or something else?

                  rict
                  • 6. RE: Purge doesn't Purge
                    metalhead
                    You must use a tool like Microsoft´s Query Analyzer (shipped with MSSQL) or a freeware tool to run SQL commands on a SQL database.
                    • 7. RE: Purge doesn't Purge


                      Tom,

                      Thanks for the info. But we have DBAs that have those duties; I would get in BIG trouble if I tried to manipulate the database from other than the application.

                      But I was able to purge, finally! As I mentioned below "I've tried to purge the DB both from the main Event Log screen of events older than 2 months, and from a Query screen of events matching some other specs, but neither has any effect on the events in the log...even though the "Action Taken" windows says the action was successfully completed..."

                      But the program WOULD purge the database if I created a Query of DATES rather than EVENTS, and then ran that as part of the Purge function. I was able to purge all the events between 3/1/08 (the installation of this server/system) and 7/1/08. So now my database is down to a manageble size, and I have the technique for further purges.

                      Success...I love it!

                      rict