ePolicy Orchestrator doesn't parse events 1092, 1094, and 1095

Technical Articles ID: KB87723
Last Modified: 2023-02-22 22:16:56 Etc/GMT

Environment

Endpoint Security (ENS) 10.x

Problem

The ePO Event Parser fails to process events 1092, 1094, and 1095 from ENS.

When the issue occurs, the managed product events sent to ePO are not parsed and are added to <ePO installation folder>\DB\Events\Debug.

The EventParser.log records errors similar to the following:

E   #01988   EPOEVENTS   epoevents_dao.cpp(212): COM Error 0x80040E07, source=Microsoft OLE DB Provider for SQL Server, desc=The conversion of data type nvarchar to datetime produced a value out of range., msg=IDispatch error #3079
E   #01880   EVNTPRSR   source\server.cpp(1218): COM Error 0x80040E07, source=(null), desc=(null), msg=IDispatch error #3079
E   #01880   EVNTPRSR   source\server.cpp(1285): Failed to process file C:\PROGRA~2\McAfee\EPOLIC~1\DB\Events\8a28215b-95e6-4843-b384-e62e61e4c38a-mc_20160905114624553699200000B30.xml.

Cause

One of the conditions below applies:

ePO uses an account for the database connection to SQL that does not have the logon language set to English.
There is a collation mismatch between the ePO database and the SQL instance. The SQL collation of the SQL Server must match the collation of the ePO database.

Solution 1

Change the logon language of the account that ePO uses for database connections to English:

Open SQL Management Express.
In the Object Explorer, select Security.
Select and expand Logins.
Right-click the account used for the ePO connection to SQL and select Properties.
In the General section, set the Default Language to English.
On the ePO server, restart the ePO services:
1. Press Windows+R, type services.msc, and click OK.
2. Right-click the following services and select Restart:
  
  McAfee ePolicy Orchestrator x.x.x Application Server
  McAfee ePolicy Orchestrator x.x.x Server
  McAfee ePolicy Orchestrator x.x.x Event Parser
3. Close the services window.

Solution 2

The SQL collation of the SQL Server must match the collation of the ePO database. For details, see: KB73717 - ePolicy Orchestrator supported SQL Server collation types.

Related Information

There are other possible causes for events from managed products not reaching ePO. If the solution in this article does not resolve your issue, see the following articles for troubleshooting steps:

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

ePolicy Orchestrator doesn't parse events 1092, 1094, and 1095

Environment

Problem

Cause

Solution 1

Solution 2

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

ePolicy Orchestrator doesn't parse events 1092, 1094, and 1095

Environment

Problem

Cause

Solution 1

Solution 2

Related Information

Affected Products

Languages:

Choose your region

Title

Title