Check event processing: best practice

Using Windows Explorer, navigate to this folder:

C:\Program Files (x86)\McAfee\ePolicy Orchestrator\DB\Events

At any time, this folder might display a few dozen or a few hundred events.

Note

In larger environments, this folder is constantly processing thousands of events per minute.

Click the Refresh icon multiple times, then look at the status bar to see the number of files in this folder changing quickly.

Confirm that the events are not occurring faster than the event parser can process them. This causes this folder to grow quickly. Use these steps to confirm the event parser is running.

1. To open the Windows Services Manager and confirm that the event parser is running, click Start, Run, type services.msc and click OK.

2. In the Services Manager list, find Trellix ePolicy Orchestrator 5.10.0 Event Parser and confirm it is Started.

Check the event parser log file for any errors, using these steps.

1. Go to the log file folder at this path:

   C:\Program Files (x86)\McAfee\ePolicy Orchestrator\DB\Logs

2. Open this log file and check for errors:

   eventparser_<serverName>.log

Use these steps if the events are still occurring faster than the event parser can process them.

1. Open the Services Managers list again and temporarily stop all three of these ePO - On-prem services:

   • Application Server

   • Event Parser

   • Server

2. Move the contents of the C:\Program Files (x86)\McAfee\ePolicy Orchestrator\DB\Events\ folder to another location, or delete the events, if you're not worried about losing the data.