Host Intrusion Prevention table HIP8_IPSEventParameter consumes large amounts of space

技術的な記事 ID: KB85126
最終更新: 9/10/2020

環境

McAfee Host Intrusion Prevention (Host IPS) 8.x
All Windows platforms

問題

If the IPS component is enabled and logging all signatures, the ePolicy Orchestrator (ePO) database expands and the database HIP8_IPSEventParameter table consumes large amounts of space.

The following is the SQL query for the table:

select object_name(id) [Table Name],
[Table Size] = convert (varchar, dpages * 8 / 1024) + 'MB'

from sysindexes where indid in (0,1)

order by dpages desc

原因

The Host IPS configuration depends on other events; this dependency prevents direct purges against the HIP8_IPSEventParameter table.

解決策

To reduce the size of the HIP8_IPSEventParameter table through purges of past events, do the following:

NOTE: See the attached "Images.zip" file, for example screenshots.

Create a query for the Host IPS Event ID that consumes the greatest amount of database space. (See image 1.png. In this example, it is Event ID 18000.)
1. Log on to the ePO console.
2. Click Menu, Reporting, Queries & Reports.
3. Click New Query.
4. Go to Feature Group, Events, and select Threat Events. (See image 2.png.)
5. Click Next.
6. For Chart Type, under List, select Table. (See image 3.png.)
7. Click Next.
8. Add the Event ID column.
9. Click Next. The Filter page appears.
10. Click Save and save the query as Threat Events_HIPS under the HIPS Group.
Create a server task to purge events for the Event ID.
1. Click Menu, Automation, Server Tasks.
2. Click New task.
3. Name the server task and click Next.
4. For Actions, select Purge Threat Event Log.
5. Select Purge by query. (See image 5.png.)
6. From the drop-down list, select the newly created query.
7. Click Next twice and click Save to save the server task.
8. Run the server task. It will purge all events for the Event ID before the specified date, in this example, January 1, 2015.

添付ファイル

Images.zip
84K • < 1 minute @ broadband

影響を受ける製品

Host Intrusion Prevention 8.0

言語:

この記事は、次の言語で表示可能です:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

技術用語集

用語集にある用語をハイライトする

当社の技術用語集を参照してください。

Knowledge Center

Host Intrusion Prevention table HIP8_IPSEventParameter consumes large amounts of space

環境

問題

原因

解決策

添付ファイル

影響を受ける製品

言語:

技術用語集

Title

Title

Knowledge Center

Host Intrusion Prevention table HIP8_IPSEventParameter consumes large amounts of space

環境

問題

原因

解決策

添付ファイル

影響を受ける製品

言語:

技術用語集

地域を選択してください

Title

Title