Summary of recommendations if NSE files are processing very slowly on SMP 7.1 Sp2
|Article:HOWTO79384|||||Created: 2012-08-29|||||Updated: 2013-02-06|||||Article URL http://www.symantec.com/docs/HOWTO79384|
~Apply KB for known issues TECH183347
~Possible corrupted index on EventQueueEntry table.
1. Truncate the EventQueueEntry table.
2. Rebuild its problematic Clustered index:
ALTER INDEX [PK__EventQue__3214EC071E6F845E] ON [dbo].[EventQueueEntry] REBUILD PARTITION = ALL WITH ( PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON, ONLINE = OFF, SORT_IN_TEMPDB = OFF )
3. Cut all the NSE files from the EventQueue folder into the EvtInbox folder.
4. Watch the files being moved back to the EventQueue folder and processed.
HOW TO check if the procedure is needed:
1. Run SQL Query in SQL Management Studio:
exec spGetCandidateEventsByQueue @queueId=0,@maxResults=10
Check if the query runs longer than 30-40 seconds.
2. Check if the EventQueue folder has a large number of files and not decreasing.
Article URL http://www.symantec.com/docs/HOWTO79384