Can't open ePO or login failed with correct password & how to shrink ePO DB（排查ePO登陆问题& 收缩ePO DB）

Troubleshooting ePO login issue:

1. Make sure three ePO services enabled , add ePO login website to trusted site, if event parser service disabled then check DB configuration, if Apache service disabled then check whether there're ports occupied by other process, kill the process

using netstat check ports:

http://ywsm.iteye.com/blog/510670

ports occupied by system process:

https://segmentfault.com/a/1190000005008567

2. Test link in https://:8443/core/config checking DB links

3. If Test link failed, check DB settings in SSMS and db.properties

4. Make sure there are enough space in DB , if DB full or too large, there will be authentication issue also

If DB full, we can shrink it according to KB68961 and using SSMS

5. Collect orion.log on ePO server , if there is any incompatible extension, uninstall it and start service

SSMS basis:

https://docs.microsoft.com/zh-cn/sql/ssms/tutorials/tutorial-sql-server-management-studio?view=sql-server-2017

排查ePO登录问题:

1. 确保ePO登录页面加到可信站点，三个服务都起来了，如果事件解析服务起不来检查数据库配置，Apache服务起不来检查端口号有没有被占用

2. 确保 https://:8443/core/config 页面检查数据库配置测试连接成功

3. 测试连接失败的话去SSMS和config页面检查数据库

4. DB满了也会导致登录失败，满了就收缩

5. 还解决不了看Orion.log，有不兼容的扩展卸掉再启服务

微软的SSMS使用文档（好评）：

https://docs.microsoft.com/zh-cn/sql/ssms/tutorials/tutorial-sql-server-management-studio?view=sql-server-2017

Shrink DB:

1. Backup ePO (disaster recovery) , capture snapshot or using KB66616

ePolicy Orchestrator server backup and disaster recoveryprocedure

https://kc.mcafee.com/corporate/index?page=content&id=KB66616

2. Clean old events, then right click ePO database in SSMS>task>shrink>database

Clean old events:

According to KB68961, run query from step 1d

How to remove old events and shrink the ePolicy Orchestratordatabase

https://kc.mcafee.com/corporate/index?page=content&id=KB68961

收缩ePO数据库：

综述：备份ePO后按照清理eventID，并在清理结束后在SSMS手动收缩数据库（右键>任务>收缩>数据库）

1. 备份ePO：

ePO如果使用的是虚拟机，请先拍摄快照，如果是物理机请按照KB66616对ePO进行完整备份

ePolicy Orchestrator server backup and disaster recoveryprocedure

https://kc.mcafee.com/corporate/index?page=content&id=KB66616

 

2. 清理eventID：按照KB68961，从步骤d开始清理eventID

How to remove old events and shrink the ePolicy Orchestratordatabase

https://kc.mcafee.com/corporate/index?page=content&id=KB68961

 

清理eventID可能会对已清理ID记录有影响，对使用没有影响，eventID是已发生的事件ID
EventID代表的意思可以在ePO菜单，server settings中选择event filter，右下角edit中查看