Undeletable events in Threat database, how to delete them at all?

[polezhaevdmi]

I found 2 old (from April and May) records in ePO 10.7.0up7 threat database could not be deleted, despite of successfull report from 'delete action'. Tried to make several attemps during 1 month period - effect is solid: these 2 events are undeletable, while all other events collected, the same action deletes without problems. The screenshot with 2 events remaining is attached. The database maintenance operation (index reorganization via ePO link) changes nothing. And I see no ePO Performance Optimizer low-level errors, which might be coupled with database corruption.

Customer's segment is separated from Internet, thus, the operations I must perform by myself.

How is it possible to try to delete the mentioned events from ePO database using ePO console? How is it possible to clean the threat events database in SQL Management Studio (I don't know the place these events residing)? Will it be reasonable to try the database maintenance as described in KB51569 document? Or, will it be better to start from Service Request at this point (to get the instructions)?

Thank You!

[Former Member · Accepted solution]

Hello @polezhaevdmi 

Thanks for your post.

Try to use Server task to purge the events from the Database.

If still no luck you can try using the below KB article :

https://kc.mcafee.com/corporate/index?page=content&id=KB68961

For fragmentation:

https://kc.mcafee.com/corporate/index?page=content&id=KB67184

If no luck please proceed with the Service Request.

Might be we need to clear this from the database itself and for that we need to execute the query.

So if nothing is helping in that case please open a Service Request with Support.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[polezhaevdmi]

vivs, a lot of thanks!

'Purge' server task - tried, and had no luck.

'Purge threat events from the ePO database based on the event ID' script from KB68961 removed both events with ID=1092, and now the database is clean.

Great!