ePO 5.10 SQL Database "_Events" large

[anyWARE]

Hi,

since the upgrade from ePO 5.9 to 5.10 we noticed a new Database. Database size is 12GB.
What about that database? How to shrink it?

Regular sjhrinking does not work, because minimum filesize of each "monthly file" is set to 1GB.
I realy do not want a 12GB default event-database. 😉

Regards
Daniel

[cdinet]

You control the size of that by purging events in epo via server tasks.  You can purge audit logs, client and threat events, server task log, etc.  It can also be controlled by what events are sent to epo.  For example, in server settings, event filtering, you can disable unwanted events.  Also, in your policy settings for point products, such as vse or ens, you can control access protection events that get sent by enabling/disabling reporting for those events.  If you don't use the info from certain event types, it does you no good to store them.  It is also not advised to limit the size of the database.  It is normal for events to take up a lot of space, depending on how many systems you are managing, number of products installed and the settings for each regarding which events are sent. 

[anyWARE]

Hello cdinet,

don't get me wrong, but your answer is some kind of generic.
I know that already. 

It's not regarding the regular events. It is regarding the new *database* since 5.10(?) called
"ePO_SERVERNAME_Events. It creates files for every month with 1GB space!

Since I did not find a single answer in the documentation (is there one?) or in the KB,
I cleared it up by reducing the minimal size of the files from 1GB to 8MB minimum size.

Where may I find informations regarding that new created database and how to handle it?


Regards
Daniel

[anyWARE · Accepted solution]

OK, so now - after speaking to the american McAfee support I have the facts, I need.

- The new "ePO_Servername_Events" Database is just a split-off from the events-tables, which resided in the regular "ePO_Servername" Database

- Because of flooding-problems in the past (thousands of generated events in special situations), McAfee decided to create a new database and store the events inside, so that the "productive" ePO database stays as small as possible

- The initial size of _Events database is variable. If you use SQL-Express, the created DB-Files are about 100MB (x12 for each month), if you use a regular SQL Server, they where about 1GB(!) each file - so 12GB in total

- Resizing the files minimum usage from 1GB to 8MB is no problem - as we did. That intuitive change we made was right