Mcafee EPO Server 5.X Database or Space growing EPOevents or OrionAuditlog

THIS KB is valid for EPO4/5 until 5.1 and even with the SPLIT in TWO database this still happens in 2024.

We just had a case where the OrionAuditlog table was 22GB+ on the MAIN DB.

Sample Problem:

VMWARE Monitoring Events from “Vmware Converter and Tools” fill the EPO Database rapidly (1GB/Hour).
delete from EPOEvents where DetectedUTC < ‘YYYY-MM-DD’
delete from EPOEvents where DetectedUTC < ‘2011-01-01’

SOLUTION: Run this SQL Script once a week to get rid of the problem

This is a batch File which you run from Schedule:

osql -S FHSEPO01\EPOSERVER -E -i c:\batch\epo.sql
echo Clean gemacht am %date% >> c:\batch\epo_clean_logfiles.txt

The is the file epo.sql which you also place in c:\batch.
Change the ePo4_Server to the NETBIOS Name of Your EPO.

Check that you have OSQL.EXE in the path somewhere (SQL Server Client Tools)

EPO4_YourEPOServernamehere = Your EPO Database

use EPO4_YourEPOServernamehere go
DELETE FROM EPOEvents WHERE (DetectedUTC < GETDATE() – 7)
go
DELETE FROM OrionAuditLog WHERE (StartTime < GETDATE() – 120)
go
DELETE FROM OrionSchedulerTaskLog WHERE (StartDate < GETDATE() – 120)
go
DELETE FROM OrionSchedulerTaskLogDetail WHERE (MessageDate < GETDATE() – 120)
go
Use master
GO
DBCC SHRINKDATABASE (EPO4_YourEPOServernamehere )
GO

Also check this place. You may delete oder CACHED defintions. Not the latest one. EPO/Windows Installer needs those to remove old version of mcafee from clients! If you dont know and understand what that means leave it and call Mcafee.

C:\Programme\McAfee\ePolicy Orchestrator\DB\RepoCache\Current\VSCANDAT1000\DAT\0000 (6-8GB after one year)

The Apache Web Server is also growing, don’t forget these files:

c:\Programme\McAfee\ePolicy Orchestrator\Apache2\Logs\ssl_request_log (250MB with around 200 clients)

c:\Programme\McAfee\ePolicy Orchestrator\Apache2\Logs\access_log (250MB with around 200 clients)

You may also check your SQL Express DB with some freeware tool (REINDEX, Shrink etc.)

Please be carefull with this command and make sure you have enough space on your harddisk. If you use SQL Express please make sure you FIRST remove

the Events from old years with above command and SQL scripts.

Get the tool from here  http://www.sqldbatips.com/showarticle.asp?ID=29

Here is how to reindex the SQL DB from EPO:

c:\batch\expressmaint -S (local)\EPOSERVER -D ALL_USER -T REINDEX -TO 120

Here is SQL Query, which shows you the largest Tables in EPO:

 ********************************************** <<<<<<<<<<< EXCLUDE THIS

SET NOCOUNT ON
/*DATABASE TABLE SPY SCRIPT
Micheal Soelter
1/24/03
DESCRIPTION
Returns Table Size Information
SORTING USAGE
@Sort bit values
0 = Alphabetically by table name
1 = Sorted by total space used by table
*/
DECLARE @cmdstr varchar(100)
DECLARE @Sort bit
SELECT @Sort = 0 /* Edit this value for sorting options */
/* DO NOT EDIT ANY CODE BELOW THIS LINE */
–Create Temporary Table
CREATE TABLE #TempTable
( [Table_Name] varchar(50),
 Row_Count int,
 Table_Size varchar(50),
 Data_Space_Used varchar(50),
 Index_Space_Used varchar(50),
 Unused_Space varchar(50)
)
–Create Stored Procedure String
SELECT @cmdstr = ‘sp_msforeachtable ”sp_spaceused “?””’
–Populate Tempoary Table
INSERT INTO #TempTable EXEC(@cmdstr)
–Determine sorting method
IF @Sort = 0

    BEGIN
    –Retrieve Table Data and Sort Alphabetically
    SELECT * FROM #TempTable ORDER BY Table_Size
END
ELSE

    BEGIN
    /*Retrieve Table Data and Sort by the size of the Table*/
    SELECT * FROM #TempTable ORDER BY Table_Size DESC
END
–Delete Temporay Table
DROP TABLE #TempTable

 ********************************************** <<<<<<<<<<< EXCLUDE THIS

SELECT     t.name AS TableName, i.name AS indexName, SUM(p.rows) AS RowCounts, SUM(a.total_pages) AS TotalPages, SUM(a.used_pages) AS UsedPages,
                      SUM(a.data_pages) AS DataPages, SUM(a.total_pages) * 8 / 1024 AS TotalSpaceMB, SUM(a.used_pages) * 8 / 1024 AS UsedSpaceMB,
                      SUM(a.data_pages) * 8 / 1024 AS DataSpaceMB
FROM         sys.tables AS t INNER JOIN
                      sys.indexes AS i ON t.object_id = i.object_id INNER JOIN
                      sys.partitions AS p ON i.object_id = p.object_id AND i.index_id = p.index_id INNER JOIN
                      sys.allocation_units AS a ON p.partition_id = a.container_id
WHERE     (t.name NOT LIKE ‘dt%’) AND (i.object_id > 255) AND (i.index_id <= 1)
GROUP BY t.name, i.object_id, i.index_id, i.name
ORDER BY OBJECT_NAME(i.object_id)

 ********************************************** <<<<<<<<<<< EXCLUDE THIS

Make sure you have enough space before you run the SQL scripts.

4GB EPO Database size:

12GB LDF Logs to clean up

Also check out EPOProductevents which has grown to 6GB on some older EPO alone.

use EPO4_YourEPOServernamehere

go
DELETE FROM EPOPRODUCTEvents WHERE (DetectedUTC < GETDATE() – 7)
go

https://community.mcafee.com/message/347221

 For extreme large DB and space 50-80 GB we recommend to shrink in little steps:

a) Clean or truncate in steps of 1000 from a date backwards (Run Query below on your EPO DB as example)

b) Make a FULL Backup or the SQL Database 

c) Shrink

————————————————————-

DECLARE @Deleted_Rows INT;

SET @Deleted_Rows = 1;

WHILE (@Deleted_Rows > 0)

   BEGIN

    — Delete some small number of rows at a time

      DELETE TOP (1000)   OrionAuditLog

      WHERE StartTime < dateadd(DAY,-18,GETDATE())

   SET @Deleted_Rows = @@ROWCOUNT;

END

————————————————————-

See also:

https://www.butsch.ch/post/MCAFEE-EPO-SQL-shrink-large-files-in-small-steps