Event parser service starts but get stuck on ePo 5.10

[Former Member]

Hi! Mi ePo 5.10 is not getting any events from dlp agents and seems to be  an event parser fault. When i restart the server, get some events, but then stops sending. When i try to restart the service i get an error "1503: service didnt respondt in time" so the service stucks in "stopping" and i have to restart the server.

What can be the source of this problem? Seems like something collapse the service and only shows when i try to restart, because the rest of the time, seems like its working properly.

Thanks!

[Former Member]

Please check the event parser log and see is there any error reported.

Also you can check the event viewer to get more details.

If service is getting stuck in stopping state, What if you are trying to kill it from the Task Manager and restarting it again.

[tucker84]

Are you using ePO 5.10 update 4? Does your server meet the recommended specs?

[cdinet]

See if KB91749 applies and check the eventparser log to see if you have this error: HOSTDLPEVENT Error processing event. Error: SP: UDLP_eventparser_xxxxxx_SP. Error: Transaction (Process ID xx) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction. If you do, please open a ticket with dlp team to get updated sql script to add some missing indexes.

[Former Member]

Hi! I cannot find that line on the eventparser log, so i assume that is not the error. In matter of KB, i cannot find that one, maybe one number is missing?

[Former Member]

Hi! Check the recommended specs and i think that the server meet all (ntfs, 12 GB ram, 4 core, 20gb free space). Im runing 5.10.0.2428, so i assume im on 5.10 update 2? (im scared of update, previously i updated extensions and packages of threat prevention and all stop working, making me to restore all old software, but the parser error comes before that)

[Former Member]

Hello,

If possible please provide the screenshot of the error and also please provide the Eventparser.log.

By Default location:

Event Parser service: eventparser.log or eventparser_servername.log located in: ...\<epoinstallationdirectory>\db\logs\

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[cdinet]

The build of epo won't change with the updates, unlike previous patches.  Go to server settings, server information and on the right side, there is a section for installed updates.  That will tell you if you have installed any or not.  If you have not, please install update 4.  Ensure you have full backups of everything per kb66616 first.  These are critical, as they have a lot of fixes, such as a missing internal cleanup task, and other things that you might be noticing without any updates. 

The KB can be found here, but it requires you log into the service portal to get it.  With dlp 11 and5.10, it is critical that you apply the updated stored procedure for dlp, or you will continue to get no dlp events.

[dadialla]

We're experiencing the same issue in our enviroment, we are in ePO 5.10 patch 5 and following the KB91749 we've updated the DLP extension to 11.4  but it's not resolved. Right now we have a case with McAfee support and waiting to the logs analysis. Could you solve the issue @Former Member ? 

Thanks & BR 

[Former Member]

Hello,

Please go to the below location and check the eventparser.log (bottom to top) 

C:\Program Files (x86)\McAfee\ePolicy Orchestrator\DB\Logs

If you find any specific error , please let us know.