2013 McAfee, Inc. All Rights Reserved. 1. epolicy Orchestrator 5.1 Essentials

Size: px

Start display at page:

Maryann Bell
5 years ago
Views:

2 This module covers the essential information on maintaining an epo Server and database. The information presented in this module is not all inclusive. Enterprise customers most often just need to know where the must preserve data is located. From there, they ll usually throw the new setup into their existing backup and recovery plan, already set forth by the organization. The most crucial data for epo is obviously the database. The entire system can be restored with a recent copy of the database. But there is other data that can ease the process greatly in the event a restoration is needed. Students will be shown how to manage epo Security Keys, and review important logs, along with utilizing database maintenance tools McAfee, Inc. All Rights Reserved. 2

epo is not an appliance-based solution. It is installed to the customer s hardware. Therefore, customers need to maintain and protect their epo Server and database.

3 epo is not an appliance-based solution. It is installed to the customer s hardware. Therefore, customers need to maintain and protect their epo Server and database. Obviously, failure to do so will cost them a lot of downtime and headaches. They need to keep the server up-to-date on patches and updates. This includes not only McAfee epo patches, but also Microsoft patches for the operating system and the SQL database and some sort of malware protection application (i.e. VirusScan Enterprise) McAfee, Inc. All Rights Reserved. 3

4 Several of the available epo Server Tasks can assist with periodic server maintenance tasks like maintaining System Tree synchronization, managing product licenses, purging old data, maintaining repositories, and maintaining Rogue System Sensors McAfee, Inc. All Rights Reserved. 4

5 Security Keys epolicy Orchestrator uses security keys to secure the agent-to-server communication, and to sign and validate packages. Agent-to-server secure communication keys Agent-to-server secure communication (ASSC) keys are used by the agents to communicate securely with the server. You can make any ASSC key pair the master, which is the one currently assigned to agents deployed in the environment. The epo agent key Updater needs to exist in Master repository, and the McAfee Agent agent update task has to have the epo agent key updater selected. Existing agents using other keys in the list will change to the new master after their next update. It is important to be sure to wait until all agents have updated to the new master before deleting any older keys. Master repository key pair The master repository private key signs all unsigned content in the master repository. Agents use the public key to verify the repository content originating from the master repository on the epo server. If the content is unsigned, or signed with an unknown repository private key, the downloaded content is considered invalid and deleted. This key pair is unique to each server installation. However, by exporting and importing keys, you can use the same key pair in a multi-server environment. Other repository public keys These are the public keys that agents use to verify content from other master repositories in the environment or McAfee source sites. Each agent reporting to this server uses the keys in this list to verify content that originates from other epo servers in the organization, or from McAfee owned 2013 McAfee, Inc. All Rights Reserved. 5

6 sources. If an agent downloads content that originated from a source for which the agent does not have the appropriate public key, the agent will discard the content McAfee, Inc. All Rights Reserved. #

7 Customers in multi-server environments can choose to use the same ASSC key pair for all servers and agents. You can export ASSC from on McAfee epo server to a different epo server, to allow agents to access the new epo server. You can choose to make any ASSC key pair the master, which is the key pair currently assigned to all deployed agents. They can also choose to use a different ASSC key pair for each McAfee epo server to ensure that all agents can communicate with the required McAfee epo servers in an environment where each server must have a unique agent-to-server communication key pair. NOTE: Agents can communicate with one server at a time. The epo server can have multiple keys to communicate with different agents, but the opposite is not true. Agents cannot have multiple keys to communicate with multiple epo servers McAfee, Inc. All Rights Reserved. 6

ASSC Keys in Multi-Server Environments You can have both a 2048 and a 1024 bit key set as master.

You can view which systems are using a key-pair, when editing security keys, by

10 Before deleting the previous master key pair from the list, wait until all agents begin using the new master key pair. Agents begin using the new key pair after the next update with epo agent key updater selected task the agent completes. At any time, you can see which agents are using any of the ASSC key pairs in the list McAfee, Inc. All Rights Reserved. 9

11 CAUTION: Do not delete any keys that are currently in use by any agents, or those agents are not able to communicate with the server. You cannot delete a key designated as a Master Key. You must make another key the Master before deleting the old key. In epo 5.x you cannot delete a key that an agent is using McAfee, Inc. All Rights Reserved. 10

12 The master repository key pair is unique for each installation. If you use multiple servers, each uses a different key. If the agents are configured to allow the download of content that originates from different master repositories, you must ensure that agents recognize the content as valid. You can ensure this in two ways: Use the same master repository key pair for all servers and agents Ensure agents are configured to recognize any repository public key used in the environment 2013 McAfee, Inc. All Rights Reserved. 11

It is recommended that you back up all keys before making any changes

14 After installation you can change only two ports; Agent wake-up communication port, and Agent broadcast communication port. If you need to change other ports, you must either reinstall the server and reconfigure the ports in the installation wizard, or refer to available KnowledgeBase articles McAfee, Inc. All Rights Reserved. 13

Purge the Audit Log The Audit Log page is used to find and view actions taken by all users. Here, you can maintain and access records of all McAfee epo user actions.

15 Purge the Audit Log The Audit Log page is used to find and view actions taken by all users. Here, you can maintain and access records of all McAfee epo user actions. The entries are displayed in a sortable table. Customers can delete entries from the Audit Log based on a user-specified age. This action purges all audit log entries older than the specified age McAfee, Inc. All Rights Reserved. 14

16 Purge the Threat Event Log The Threat Event Log page allows you to view and manage the event files in the database. You can purge events from the log based on a user-specified age. The action deletes the all the event log entries older that the specified age McAfee, Inc. All Rights Reserved. 15

Purge Old Data The idea is that customers should be purging data on a regular basis. Here s an example of a task that they should run every single day.

17 Purge Old Data The idea is that customers should be purging data on a regular basis. Here s an example of a task that they should run every single day. Review the 9 actions setup in this example server task. Notice the 8 th action is configured to purge by query. This is just an example, but it illustrates the power behind server tasks, and represents a modest approach to keeping the database clean McAfee, Inc. All Rights Reserved. 16

Customers may find themselves needing to migrate the database to another server, or they may want to upgrade the hardware on the existing server.

18 Customers may find themselves needing to migrate the database to another server, or they may want to upgrade the hardware on the existing server. Before performing any migration, the first step is to back up the database. The steps involved in the migration process depend on many factors. Are they keeping the server name and IP the same? Is one changing but not the other? Will there be any network communication boundaries that need to be acknowledged and dealt with? Etcetera. Additional information: KB How to change the epo and Agent-to-Server communication port 80 KB How to change epo Agent-to-Server Communication secure port 443 KB How to change the epolicy Orchestrator 4.x Console-to-Application Server communication port 8443 KB How to change the epolicy Orchestrator 4.x Client-to-server authenticated communication Port McAfee, Inc. All Rights Reserved. 17

Customer may also need to migrate their epo server. This topic explains the process of migrating an existing epo Server to a new hardware platform according to recommended procedure.

19 Customer may also need to migrate their epo server. This topic explains the process of migrating an existing epo Server to a new hardware platform according to recommended procedure. This information is intended for use by network and epo administrators only. These instructions are intended guidelines for migration. All liability for use remains with the user. The instructions in this topic can also be used for disaster recovery. NOTE: The Agent uses either the last known IP address, DNS name, or NetBIOS name of the epo server. If you change any one of these, ensure that the Agents have a way to locate the server. The easiest way to do this would be to retain the existing DNS record and change it to point to the new IP address of the epo server. After the Agent is able to successfully connect to the epo server, it downloads an updated SiteList.xml with the current information. The procedure can also be used by customers who want to migrate the epo server to another system. For epo 5.x users, it is preferable to use the built-in Disaster Recovery feature to migrate the epo server to another system McAfee, Inc. All Rights Reserved. 18

20 In preparation for server migration, you will want to backup the folders shown here on the server. There are multiple KB articles available on how to backup the SQL database McAfee, Inc. All Rights Reserved. 19

21 It is important to back up the epo Key-Store pairs. The task shown here backs up the repository and agent communication keys. These are stored in the following folder by default:...\program Files\McAfee\ePolicy Orchestrator\DB\Keystore\ 2013 McAfee, Inc. All Rights Reserved. 20

$ini file located in the previous installation (\Program Files (x86)\mcafee\epolicy Orchestrator\DB) stores the following information: HTTPPort= 80 (Agent-to-Server communication port) AgentHttpPort=$

22 You must reinstall epo to the exact same directory path as the previous installation or the initialization of extensions will fail when the restore is complete. The server.ini file located in the previous installation (\Program Files (x86)\mcafee\epolicy Orchestrator\DB) stores the following information: HTTPPort= 80 (Agent-to-Server communication port) AgentHttpPort= 8081 (Agent Wake-Up communication port) SecureHttpPort= 8443 (Console-to-Application Server communication port) BroadcastPort= 8082 (Agent Broadcast communication port) If you use the original SQL server, the installer will attempt to create a database called epo_<epo_servername>. Because the name of the original epo server is retained, the original database has to be backed up and detached. Otherwise, the installer prompts you to overwrite the existing database McAfee, Inc. All Rights Reserved. 21

23 1. Log on to the new epo server. 2. On the new epo server, click Start, Run, type services.msc, and click OK. Right-click each of the following services and select Stop: McAfee epolicy Orchestrator Application Server McAfee epolicy Orchestrator Event Parser McAfee epolicy Orchestrator Server 3. Click Start, Run, type cmd and click OK. 4. If you backed up the database using OSQL commands, to restore the epo database type the following command and press ENTER: sqlcmd -E -S servername\instancename -Q "RESTORE DATABASE epo4_servername FROM DISK = 'c:\backupdirectory\test NOTE: Where c:\backupdirectory\test is the location where the database backup is located. 5. Close the command prompt window McAfee, Inc. All Rights Reserved. 22

$1. Before you enable and start the epo services, ensure that the contents (version numbers) of the C:\Program Files\McAfee\ePolicy Orchestrator\server\extensions\installed folder match the extensions$

25 1. Before you enable and start the epo services, ensure that the contents (version numbers) of the C:\Program Files\McAfee\ePolicy Orchestrator\server\extensions\installed folder match the extensions listed in the OrionExtensions table. To check the contents of the OrionExtensions table, access the SQL Tools and run the following T- SQL command: Select * from OrionExtensions If there is a mismatch on server startup, the server removes each extension not listed in the OrionExtensions table. If this happens, check in these extensions again and also restore the database again. 2. Start the McAfee epolicy Orchestrator Application Server service. NOTE: You must start this service for RunDllGenCerts to work. 3. Rename the SSL.CRT folder (see path below) to SSL.CRT.OLD and manually create an empty folder named SSL.CRT in the same path, otherwise the setup will fail to create a new Cert: "C:\Program Files\McAfee\ePolicy Orchestrator\APACHE2\CONF\SSL.CRT" Continued on next page 2013 McAfee, Inc. All Rights Reserved. 24

26 4. Click Start, Run, type cmd, and click OK. 5. Change directories to your epo installation directory. Default paths: Program Files\McAfee\ePolicy Orchestrator\ 6. Run the following command: IMPORTANT: - This command will fail if you have enabled User Account Control (UAC) on this server. If this is a Windows Server 2008 or later, disable this feature. You can find more information about UAC at: - This command is case-sensitive. The ahsetup.log (found in <installdir\apache2\conf\ssl.crt>) provides information about whether the command succeeded or failed and will state if it used the files located in the ssl.crt folder Rundll32.exe ahsetup.dll RunDllGenCerts <eposervername> <console HTTPS port> <admin username> <password> <"installdir\apache2\conf\ssl.crt"> where: <eposervername> is your epo server NetBIOS Name <console HTTPS port> is your epo Console Port (default is 8443) <admin username> is admin (use the default epo admin account) <password> is the password to the epo Admin console account <installdir\apache2\conf\ssl.crt> is your installation path to the Apache folder; Default installation path: 64-bit: "C:\Program Files (x86)\mcafee\epolicy Orchestrator\APACHE2\CONF\SSL.CRT" Example: Rundll32.exe ahsetup.dll RunDllGenCerts eposervername 8443 administrator password "C:\Program Files (x86)\mcafee\epolicy Orchestrator\APACHE2\CONF\SSL.CRT" 7. Start the following services: McAfee epolicy Orchestrator Event Parser McAfee epolicy Orchestrator Server 2013 McAfee, Inc. All Rights Reserved. 25

Before backing up If possible, shut down the McAfee epolicy Orchestrator 5.1.0 Application Server service (Tomcat) entirely when doing the backup.

27 Before backing up If possible, shut down the McAfee epolicy Orchestrator Application Server service (Tomcat) entirely when doing the backup. Otherwise just make sure no one is installing, uninstalling, or upgrading an extension during the backup. Normally backups occur during non-peak times (which is at night usually), so this shouldn t be a big concern McAfee, Inc. All Rights Reserved. 26

$The folder paths shown here should be backed up on the epo Server: C:\Program Files\McAfee\ePolicy Orchestrator\SERVER\ All installed extensions and configuration information for the epo Application$

28 McAfee advises that customers place the epo Server and database into their backup routines/schedules. The folder paths shown here should be backed up on the epo Server: C:\Program Files\McAfee\ePolicy Orchestrator\SERVER\ All installed extensions and configuration information for the epo Application Server service is found here. Failure to backup and restore this directory results in a re-installation of epo to create new ones using a clean database installation. C:\Program Files\McAfee\ePolicy Orchestrator\DB\SOFTWARE\ All Products that have been checked into the Master Repository are located here. C:\Program Files\McAfee\ePolicy Orchestrator\DB\KEYSTORE\ The agent, Server, and Repository Keys that are unique to the installation are located here. Failing to restore this folder, results in re-pushing the agent to all the systems, and checking in all of the deployable packages again. C:\Program Files\McAfee\ePolicy Orchestrator\APACHE2\CONF The Server configuration settings for Apache, the SSL Certificates needed to authorize the server to handle agent requests, and Console Certificates are located here McAfee, Inc. All Rights Reserved. 27

29 If the customer is concerned about the amount of data being backed up, or if the customer simply wants to reduce the number of items to back up they can exclude the following subfolders from the \SERVER folder: C:\Program Files\McAfee\ePolicy Orchestrator \server\logs (server log files) C:\Program Files\McAfee\ePolicy Orchestrator\server\cache (contains cached information created and used by epo, such as generated chart images) C:\Program Files\McAfee\ePolicy Orchestrator\server\work (contains cached information about web applications registered with Tomcat; Tomcat will regenerate that information, if deleted) 2013 McAfee, Inc. All Rights Reserved. 28

30 A feature introduced in epo 5.0 is Disaster Recovery. This feature will save to the database all the required content needed for backup and restoration. Disaster Recovery The epolicy Orchestrator Disaster Recovery feature uses a Snapshot process to save specific McAfee epo server database records to the epolicy Orchestrator Microsoft SQL database. The records saved by the Snapshot contain the entire epolicy Orchestrator configuration at the specific time the Snapshot is taken. Once the Snapshot records are saved to the database, you can use the Microsoft SQL backup feature to save the entire epolicy Orchestrator database and restore it to a another SQL server for an epolicy Orchestrator restore McAfee, Inc. All Rights Reserved. 29

31 When the installation wizard starts, you can choose to restore epo from an existing database snapshot. What is a snapshot? epo 5.x comes with a supported mechanism for disaster recovery which helps you quickly recover, or reinstall the epolicy Orchestrator software. Disaster Recovery uses a Snapshot process that periodically saves the epolicy Orchestrator configuration, extensions, keys, and more, to Snapshot records in the epolicy Orchestrator database McAfee, Inc. All Rights Reserved. 30

32 Using the restored epolicy Orchestrator SQL database server, that includes the Disaster Recovery Snapshot, you can connect it to: - Restored McAfee epo server hardware with the original server name and IP address This allows you to recover from, for example, a failed epolicy Orchestrator software upgrade. - New McAfee epo server hardware with the original server name and IP address - New McAfee epo server hardware with a new server name and IP address This allows you to, for example, move your server from one domain to another. - This example can provide a temporary network management solution while you rebuild and reinstall the McAfee epo server hardware and software back to its original domain. - Restored or new McAfee epo server hardware with multiple network interface cards (NICs) You must confirm the correct IP address is configured for the McAfee epo server NIC. The Snapshot is configured, depending on your SQL database version, to automatically run every day. If you configure a script to automatically run the SQL Backup and to copy the SQL backup file to your restore SQL database server, then you can more easily restore your McAfee epo server. In addition, you can manually take a Snapshot or run your scripts to quickly save and backup particularly complex or important epolicy Orchestrator changes McAfee, Inc. All Rights Reserved. 31

The epolicy Orchestrator software installation using the Disaster Recovery Snapshot file includes these general steps performed on the McAfee epo restore server: 1.

33 The epolicy Orchestrator software installation using the Disaster Recovery Snapshot file includes these general steps performed on the McAfee epo restore server: 1. Find the SQL database backup file, copied in step 3, of the previous section, and use either the Microsoft SQL Server Management Studio or the RESTORE (Transact-SQL) command-line process to restore the primary SQL server configuration to the restore SQL server. 2. During the epolicy Orchestrator database software installation: a. On the Software Welcome dialog box, click Restore epo from an existing Disaster Recovery database Snapshot. b. Select Microsoft SQL Server to link the epolicy Orchestrator software to the restore SQL database that had the primary McAfee epo server configuration restored in step 1. After the epolicy Orchestrator software installation is started, the database records saved during the Snapshot process are used in the software configuration instead of creating new records in the database. 3. If you changed the last known IP address, DNS name, or NetBIOS name of the primary McAfee epo server, when creating the restore McAfee epo server the McAfee Agents will not be able to connect to the restored McAfee epo server. The easiest way to do this is to create a CNAME record in DNS that points requests from the old IP address, DNS name, or NetBIOS name of the primary McAfee epo server to the new information for the restore McAfee epo server. Now the McAfee epo restore server is running with the exact same configuration as the primary server. The clients can connect to the restore server and you can manage them exactly as before the 2013 McAfee, Inc. All Rights Reserved. 32

35 To quickly reinstall a McAfee epo server, configure a Disaster Recovery snapshot to save, or confirm a snapshot is being saved to the SQL database. Then back up that SQL database, which includes the snapshot, and copy the database backup file to a restore SQL Server. Disaster Recovery can be performed via: Dashboard monitor Scheduled Server Task The epo Server Snapshot monitor, found on your epolicy Orchestrator dashboard, allows you to manage and monitor your Snapshots in one place. Using the Server Snapshot monitor allows you to: Click Take Snapshot to manually save a McAfee epo server Snapshot McAfee, Inc. All Rights Reserved. 33

This page displays information and log messages about the most

Confirm the date and time the last Snapshot was saved to the SQL

The color and title of the Snapshot monitor tells you the status of your latest Snapshot. For example: - Green, Snapshot Saved to Database Snapshot process completed successfully and it is up to date.

40 The color and title of the Snapshot monitor tells you the status of your latest Snapshot. For example: - Green, Snapshot Saved to Database Snapshot process completed successfully and it is up to date. - Blue, Saving Snapshot to Database Snapshot process is in progress. - Red, Snapshot Failed An error occurred during the Snapshot process. - Orange, Snapshot Out of Date Changes to the configuration have occurred and a recent Snapshot has not been saved. Changes that trigger a Snapshot Out of Date status include: Any extension changed. For example updated, removed, deleted, upgraded, or downgraded The "Keystore" folder changed. The "conf" folder changed. The Disaster Recovery passphrase changed in Server Settings. And finally the - Grey, No Snapshot Available No Disaster Recovery Snapshot has been saved McAfee, Inc. All Rights Reserved. 38

41 You can use the Disaster Recovery Snapshot Server Task to disable and enable the Snapshot server task schedule. The Snapshot server task schedule is enabled, by default, for the Microsoft SQL Server database and disabled, by default, for the Microsoft SQL Server Express Edition database McAfee, Inc. All Rights Reserved. 39

Using Disaster Recovery to restore the epolicy Orchestrator software requires certain hardware, software, access privileges, and information.

42 Using Disaster Recovery to restore the epolicy Orchestrator software requires certain hardware, software, access privileges, and information. You need two hardware server platforms: - The existing McAfee epo server hardware, referred to as the "primary" McAfee epo server. - Duplicate epo server hardware, referred to as the "restore" server, running Microsoft SQL that matches the primary McAfee epo server database. - This restore server should be kept up to date with the latest primary McAfee epo SQL database server configuration using Snapshot and Microsoft SQL backup processes. To avoid backup and restore problems, the primary and restore server hardware and SQL versions should closely match McAfee, Inc. All Rights Reserved. 40

43 Hardware Requirements 1. The server hardware requirements are determined by the number of systems managed 2. This server hardware should closely mirror your primary McAfee epo server hardware. 3. This primary server should be up and running correctly with a recent Snapshot saved in the SQL database. 4. The primary SQL database, stores the McAfee epo server configuration, client information, and Disaster Recovery Snapshot records. Software Requirements 1. Using either the Microsoft SQL Server Management Studio or the BACKUP (Transact-SQL) command-line, you can create a backup file of the primary database including the Snapshot records. 2. Using either the Microsoft SQL Server Management Studio or the RESTORE (Transact-SQL) command-line, you can restore the primary database including the Snapshot records on the restore SQL database server to duplicate the configuration of the primary SQL database. 3. This software, downloaded from the McAfee website, is used to install and configure the restore McAfee epo server. Information Requirements 1. This passphrase was added during the initial installation of the epolicy Orchestrator software and decrypts sensitive information stored in the Disaster Recovery Snapshot. 2. You must be able to access both the primary and restore servers and the SQL database as, for example, DBOwner and DBCreator. 3. If you change any one of these during the McAfee epo server restore, ensure that the McAfee Agents have a way to locate the server. The easiest way to do this is to create a Canonical Name (CNAME) record in DNS that points requests from the old IP address, DNS name, or NetBIOS name 2013 McAfee, Inc. All Rights Reserved. 41

Using Disaster Recovery to create an epolicy Orchestrator server Snapshot provides you with a quick recovery method for the McAfee epo server.

45 Using Disaster Recovery to create an epolicy Orchestrator server Snapshot provides you with a quick recovery method for the McAfee epo server. Configure Disaster Recovery Server Settings You can change the Keystore encryption passphrase used when you installed the epolicy Orchestrator software and link it to an SQL database restored with Disaster Recovery Snapshot records McAfee, Inc. All Rights Reserved. 42

46 McAfee recommends making specific maintenance settings to epolicy Orchestrator databases. Depending on the customer s deployment of epolicy Orchestrator, they should plan on spending a few hours each week on regular database backups and maintenance. The tasks discussed in this section should be performed on a regular basis, either weekly or daily. NOTE: The customer should be advised to review their SQL documentation or seek advice with their Database Administrator for details on maintaining their epo database. McAfee recommends having a database maintenance plan that performs a backup of the epo database, together with "Simple Recovery." In this way, once a backup is successfully created, the portion of the transaction log in the active database is dropped; it is no longer needed because a backup file exists. The Simple recovery mode is recommended by McAfee because the transaction log is not essential in simple recovery mode and does not swell during backup. If you have multiple databases with different recovery models, you can create separate database maintenance plans for each recovery model. In this way, you can include a step to back up the transaction logs only on the databases that do not use the simple recovery mode. In simple recovery, once a checkpoint is complete, the transaction logs for the time before the checkpoint are dropped from the active database. A checkpoint automatically occurs when the 2013 McAfee, Inc. All Rights Reserved. 43

Every database in SQL is made up of MDF and LDF files. The epo database will have its own MDF and LDF files. The MDF file contains the actual database content.

48 Every database in SQL is made up of MDF and LDF files. The epo database will have its own MDF and LDF files. The MDF file contains the actual database content. The LDF file records all transactions that occur. Each data modification in a SQL Server database is immediately recorded to disk in a transaction log file with an LDF extension. In the event of a server problem, such as the server losing power, SQL Server can scan its logs for any data modifications that were committed and write them to permanent storage in the database. It also rolls back or undoes any modifications that were not committed by the client program. This architecture ensures that the data in the database remains consistent McAfee, Inc. All Rights Reserved. 44

49 The epo databases require regular maintenance to promote optimal performance and to protect the data. Use the Microsoft management tool appropriate for the version of SQL being used: SQL 2008 and 2012: SQL Server Management Studio SQL Express: SQL Server Management Studio Express Depending on the deployment of the epolicy Orchestrator software, customers should plan on spending a few hours each week on regular database backups and maintenance. Perform these tasks regularly, either weekly or daily. However, these tasks are not the only maintenance tasks available. See the SQL documentation for details on what else you can do to maintain the database. Important: Use the epo Disaster Recovery Snapshot feature to periodically save the epo configuration, extensions, keys, and more to Disaster Recovery Snapshot records in the SQL database. This allow you to quickly recover if the hardware hosting the McAfee epo server ever fails McAfee, Inc. All Rights Reserved. 45

When epo is installed it creates a primary data file that represents the epo database and a transaction log file. The Primary file name is epo_<servername>.mdf.

50 When epo is installed it creates a primary data file that represents the epo database and a transaction log file. The Primary file name is epo_<servername>.mdf. Customers should monitor the size of this file to determine how large the epo database is growing. The transaction log file is named epo_<servername>_log.ldf. As transactions are sent to the SQL Server it records every transaction in a transaction log to maintain database consistency and aid in recovery. The log is a storage area that automatically tracks changes to a database. As modifications are executed they are written to disk within this log, before they are written to the database. It is extremely important that you backup the database in order to reduce the size of the transaction log file, otherwise it continues to expand and fill up the hard drive. You can find these files on the database server. The default location is: C:\Program Files\Microsoft SQL Server\MSSQLx.x\MSSQL\DATA\ 2013 McAfee, Inc. All Rights Reserved. 46

51 You must have a proper database maintenance plan configured to ensure that the epo database performance is healthy. There are two ways to create a maintenance plan: Maintenance Plan Wizard: Recommended for creating basic maintenance plan. New Maintenance Plan: Allows you to utilize enhanced workflow. To create or manage Maintenance Plans, you must be a member of the sysadmin fixed server role. Note that this section provides a high-level view of how to create a basic Maintenance Plan for the epo SQL database. For detailed information, including supported procedures, refer to the documentation or help for the SQL Server edition installed for your epo environment, as well as the Microsoft TechNet site ( McAfee, Inc. All Rights Reserved. 47

52 To create a maintenance plan for the epo database, complete the following steps. For demonstration purposes, the SQL Server instance hosting the epo database in this example, is running SQL Server 2008 R2. 1. Click All Programs > Microsoft SQL Server <version >. 2. Expand the Microsoft SQL Server <version > folder, then click SQL Server Management Studio. A Connect to Server dialog opens. 3. Make sure Authentication is set to Windows Authentication, then click Connect. Note that the User Name and Password fields are grayed out, when Windows Authentication is select McAfee, Inc. All Rights Reserved. 48

$Expand the server (for example, MLD-EPO\EPOServer). Expand the Management folder. Right-click on Maintenance Plans. Select Maintenance Plan Wizard. 5. When prompted, click Next to continue.$

53 Creating Maintenance Plan (Continued) 4. Launch the Maintenance Plan Wizard, which guides you through creation of a plan, customized to meet your maintenance requirements. Expand the server (for example, MLD-EPO\EPOServer). Expand the Management folder. Right-click on Maintenance Plans. Select Maintenance Plan Wizard. 5. When prompted, click Next to continue McAfee, Inc. All Rights Reserved. 49

Creating Maintenance Plan (Continued) 6. In the Name box, type a meaningful name; for example, epo SQL Database Maintenance Plan. Optionally, enter a Description. 7.

54 Creating Maintenance Plan (Continued) 6. In the Name box, type a meaningful name; for example, epo SQL Database Maintenance Plan. Optionally, enter a Description. 7. Keep the Single schedule for the entire plan or no schedule setting. 8. Click the Change button to define a schedule for when maintenance plan executes. The default is Not Scheduled (On Demand). NOTE: Maintenance plans can contain multiple sub-plans, hold collections of tasks. Each sub-plan can be scheduled to run its tasks at different times McAfee, Inc. All Rights Reserved. 50

Creating Maintenance Plan (Continued) 9. You are prompted to define Job Schedule Properties. Note the name field is prepopulated, based on your entry on the previous dialog. 10.

55 Creating Maintenance Plan (Continued) 9. You are prompted to define Job Schedule Properties. Note the name field is prepopulated, based on your entry on the previous dialog. 10. For Schedule type, select one of the options from the drop list; for example, Recurring. Other options are: Start automatically when the SQL Server Agent launches Start whenever the CPUs become idle One time NOTE: The fields on the dialog change, depending on the selected Schedule Type. If you select Recurring, define the Frequency and Duration. If One time is selected, define the Occurrence (date and time). If you select one of the Start options, then there are no fields to define. 11. To ensure the task runs, make sure Enabled is selected (check, tick). 12. After completing the dialog to meet your scheduling needs, then click OK. You are returned to the Select Plan Properties dialog McAfee, Inc. All Rights Reserved. 51

Creating Maintenance Plan (Continued) 13.

57 Creating Maintenance Plan (Continued) 14. Select the following maintenance tasks, then click Next. Check Database Integrity: Performs internal consistency checks of data and index pages within the database. Rebuild Index: Reorganizes data on the data and index pages by rebuilding indexes. This improves performance of index scans and seeks. This task also optimizes the distribution of data and free space on the index pages, allowing faster future growth. Back Up Database (Full): Allows you to specify the source databases, destination files or tapes, and overwrite options for a full backup. Important: Avoid Shrinking Database, as much as possible. This introduces logical fragmentation (physical order of the pages in the leaf level of an Index is not the same as the logical order of the pages). Effectively, the disk head has to go back and forth in reading the pages, thus performing more I/O operations and degrading performance. When you perform a shrink of the data file, pages at the end of the data file are moved to the beginning of the file, disregarding any potential fragmentation that is introduced in this process McAfee, Inc. All Rights Reserved. 53

58 Creating Maintenance Plan (Continued) 15. Use the Move Up/Move Down buttons to define order for the tasks to execute as follows, then click Next: First: Check Database Integrity Second: Back Up Database (Full) Third: Rebuild Index NOTE: These tasks can be interchangeable in terms of the order in which they execute. McAfee recommends a database backup before the index rebuild process. This is to ensure there is a working backup copy of the database in case of an issue during the rebuild process McAfee, Inc. All Rights Reserved. 54

59 Creating Maintenance Plan (Continued) 16. Click the down arrow by the Databases drop list. A popup menu opens. 17. Click the These Databases radial button, select Databases: epo_<servername> (check, tick box), then click the OK button. 18. Click Next to continue McAfee, Inc. All Rights Reserved. 55

60 Creating Maintenance Plan (Continued) 19. Click the down arrow by the Databases drop list. A popup menu opens. 20. Click the These Databases radial button, select Databases: epo_<servername> (check, tick box), then click the OK button. 21. Again, click the These Databases radial button, select Databases: epo_<servername> (check, tick box), then click the OK button to return to the Define Backup Database (Full) Task. See the dialog continuation on the next page McAfee, Inc. All Rights Reserved. 56

61 Creating Maintenance Plan (Continued) 22. Click the down arrow by the Databases drop list. A popup menu opens. 23. Again, click the These Databases radial button, select Databases: epo_<servername> (check, tick box), then click the OK button to return to the Define Backup Database (Full) Task. In the Folder box, type the backup path location. 24. In the Set backup compression drop down, select Compress backup. 25. Click Next to continue McAfee, Inc. All Rights Reserved. 57

62 Creating Maintenance Plan (Continued) 26. Click the down arrow by the Databases drop list. A popup menu opens. 27. Again, click the These Databases radial button, select Databases: epo_<servername> (check, tick box), then click the OK button to return to the Rebuild Index Task. 28. For Object, select Tables and Views. 29. For Free space options, click the Change free space per page percentage radial button, then type 10 in the % (percentage) box. 30. For Advanced options, select Keep index online while reindexing. NOTE: Online Index rebuild is not supported by all editions of SQL Server. For more details on which editions support the Online Index rebuild, refer to SQL Server Books Online documentation. For index types that do not support online index rebuilds, select the option Rebuild Indexes offline. 31. Click Next to continue. NOTE: An Index Rebuild task causes the statistics to be updated as part of the rebuild (effectively with full scan) so an Update Statistics task is not needed after a Rebuild Index McAfee, Inc. All Rights Reserved. 58

Creating Maintenance Plan (Continued) 32. Select Write a report to a text file, and type the desired folder location in the box. 33. Click Next to continue.

63 Creating Maintenance Plan (Continued) 32. Select Write a report to a text file, and type the desired folder location in the box. 33. Click Next to continue. NOTE: To use the report option, you must have Database Mail enabled and correctly configured with MSDB as a Mail Host Database, and have a Microsoft SQL Server Agent operator with a valid address. The mail part of this task uses the sp_notify_operator statement McAfee, Inc. All Rights Reserved. 59

64 McAfee recommends that customers back up their epo SQL databases regularly, to protect data and guard against hardware and software failure. Archiving Data One successful strategy adopted by customers is to refresh their database every 6 months in the following way: 1. Back up the database according to their requirements for being able to restore data (e.g. every week, two weeks etc.). 2. Every six months, restore a copy from the most current backup, (typically the night before), but restore it under a different name, (e.g. epo_janjun13, epo_juldec13 or similar. 3. Verify that the restored database is working correctly, (i.e. reports function, etc.) 4. Delete all events from the live database from January to June (or July to December if the backup represents the second half of the year). 5. Then detach the database and bring it up when required. Using this method ensures that the backups are functional and that the backup plan is working appropriately McAfee, Inc. All Rights Reserved. 60

65 Changing SQL Server information in epo Use this task to edit the SQL Server connection configuration details. This is useful for making changes to the user account information in epolicy Orchestrator when you have made changes to the SQL Server authentication modes in another program, for example, SQL Server Enterprise Manager. You can also do this if you need to use a privileged SQL user account for added network security. Things to know about this page: Authentication If the database is running, use normal epo user authentication and only a global administrator is allowed access. If the database is down, a connection is required from the system running the server. The epo server must be restarted for any configuration changes to take effect. Use the steps below to open the Database Configuration page for epo using a web connection: 1. Launch Browser 2. Navigate to the URL below to open the Configure Database Settings page: port>/core/config 3. Under Configure Database Settings, modify entries as needed: NOTE: If any changes are made to the entries on this page, ensure that you click Test Connection (bottom right corner) to verify the connection to the database is successful with the new settings before continuing. Once you are satisfied with the new settings, click Apply McAfee, Inc. All Rights Reserved. 61

The following, are steps for using test.udl to confirm the database credentials outside of epo: 1. Create a file on the epo server called test.udl. 2. Double-click the test.udl file. 3.

66 The following, are steps for using test.udl to confirm the database credentials outside of epo: 1. Create a file on the epo server called test.udl. 2. Double-click the test.udl file. 3. Click the Provider tab. 4. Select Microsoft OLE DB Provider for SQL Server. 5. Click Next. 6. On the Connection tab, enter the same information entered in epo's core/config page for the database connection: In the Select or enter a server name field, type the SQL server name in the following format: <servername>\<instancename>,<port> NOTE: If no named instance is in use, use the following format: <servername>,<port> 2013 McAfee, Inc. All Rights Reserved. 62

67 You should be aware that Microsoft recommends using Windows Authentication for best security. McAfee recommends however, in utilizing SQL authentication, if using Remote Agent Handlers. As always, is an excellent resource for information and articles for all versions of MS SQL Server McAfee, Inc. All Rights Reserved. 63

sqlcmd Utility The sqlcmd utility lets you enter Transact-SQL statements, system procedures, and script files at the command prompt, in Query Editor in SQLCMD mode, in a Windows script file or in an

68 sqlcmd Utility The sqlcmd utility lets you enter Transact-SQL statements, system procedures, and script files at the command prompt, in Query Editor in SQLCMD mode, in a Windows script file or in an operating system (Cmd.exe) job step of a SQL Server Agent job. This utility uses OLE DB to execute Transact-SQL batches. sqlcmd replaces osql for initiating command-line transactions in SQL server and can be used to perform such actions as initiating a backup from a command line. For detailed information please see: sqlcmd Utility Transact-SQL Syntax Conventions (Transact-SQL) (SQL 2008 and SQL 2012) McAfee, Inc. All Rights Reserved. 64

[SQL MAINTENANCE PLAN] Create a maintenance plan to do integrity check, back up, shrink and clean old file created by the plan on database.

[SQL MAINTENANCE PLAN] Create a maintenance plan to do integrity check, back up, shrink and clean old file created by the plan on database. Maintenance Plan 1. Open Microsoft SQL Management Studio to find