1051 and 1059 events can make up 80 percent of the events stored in your database. If enabled, make sure that you periodically purge these events.
If you have not looked at Event Filtering on your ePO - On-prem server in a long time, run the custom Event Summary Query and check the output.
The two most common events seen in customer environments are:
1051 — Unable to scan password-protected file
1059 — Scan timed out
These two events can be enabled on the ePO - On-prem server. If you never disabled them, you might find a significant number of these events when you run the Event Summary Query. These two events can, for some users, make up 80 percent of the events in the database, use a tremendous amount of space, and impact the performance of the database.
Caution
The 1059 events indicate that a file was not scanned, but the user was given access. Disabling the 1059 event means that you lose visibility of a security risk.
So why are these events in there? These events have historic significance and go back several years and are meant to tell you that a file was not scanned by Threat Prevention. This failure to scan the file might be due to one of two reasons:
The scan timed out due to the size of the file, which is a 1059 event.
It was inaccessible due to password protection or encryption on the file, which is a 1051 event.
Disable these two events under event filtering, to prevent a flood of these events into your database. By disabling these events, you are effectively telling the agent to stop sending these events to ePO - On-prem.
Note
Threat Prevention still logs these events in the On-access scanner log file for reference on the local client.
Optionally, you can disable additional events, but this is not typically needed because most of the other events are important and are generated in manageable numbers. You can also enable additional events, as long as you monitor your event summary query to make sure that the new event you enabled does not overwhelm your database.