Loading...

Knowledge Center


High event flow in the SCOR_FD_Data_Channel temporary table results in a deadlock and events stacking up
Technical Articles ID:   KB90818
Last Modified:  8/14/2018

Environment

McAfee Application and Change Control (MACC) extension 8.1.x - 8.2.0, 8.0.x - 8.0.2, 7.x, 6.x

Problem

High event flow in the SCOR_FD_Data_Channel temporary table causes a deadlock. As a result, events stack up.
 

Cause

The deadlock issue occurs because several processes try to delete a row in the SCOR_DF_Data_Channel and the original table index cannot speed up the search.

Solution

This issue is tentatively scheduled to be corrected in the MACC 8.3 extension. Release date information for this extension is not available.

NOTE: Any future product functionality or releases mentioned in the Knowledge Base are intended to outline our general product direction and should not be relied on, either as a commitment, or when making a purchasing decision.

Workaround

To stop the deadlock occurrences, follow these steps:

  1. Stop the ePolicy Orchestrator (ePO) services:
    • Application Server
    • Event parser
    • Server
  2. Start the Microsoft SQL Server Management Studio with the ePO database credentials.
  3. Execute the following query and delete the original index:

drop index [SCOR_FD_DATACHANNEL_DETECTED_UTC] on [SCOR_FD_DATA_CHANNEL]

  1. Execute the following query and add the new index:

CREATE NONCLUSTERED INDEX [SCOR_FD_DATACHANNEL_COV_AG_DU_SN_TI] ON [dbo].[SCOR_FD_DATA_CHANNEL]
(
[AGENTGUID],
[DETECTED_UTC],
[SEQ_NO],
[TRANSACTION_ID]
)
GO

  1. Start the stopped ePO services

NOTE: If you upgrade extensions, you must reapply the index until the 8.3 extension is released and you have upgraded to it.

Rate this document

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.