Specifications

4
If the event is important, make sure you are monitoring the number of events using the
Creating event summary queries and Purging events automatically appropriately.
So if you are not looking at these events in the first place then you may consider disabling the
event completely in the VirusScan Enterprise access protection policy to stop the event from being
sent to the McAfee ePO server in the first place. Alternatively, you can adjust your policy to only
send the access protection events you are concerned with instead of excessive events that are not
being analyzed. If you do want to see these events then you can leave the policy as configured, but
make sure you are following the rules about purging events from the McAfee ePO server to make
sure these events do not overrun your database. See Purging events automatically for details.
Creating custom table queries
You can create a simple table query to take an action on events. For example, you might need to
purge data or events based on a query. Or you might have events of a specific type that are
overwhelming your database. For example, see Filtering 1051 and 1059 events.
A table query is used to returns data in a simple table format, without graphs or charts. Simple table
data can be acted upon by an ePolicy Orchestrator server task. For example, allowing you to
automatically delete this data.
Create a custom query that returns all 1051 and 1059 events in the ePolicy Orchestrator database.
Task
For option definitions, click ? in the interface.
1
Click Menu | Reporting | Queries, the Queries dialog box appears.
2
Click Actions | New Query and the Query Wizard appears starting with the Result Types tab.
3
Click Events in the Features Group and Client Events in the Result Type.
4
Click Table, under List, in the Display Results As pane to create a simple table format and click Next.
Reporting
Custom queries
11
McAfee
®
ePolicy Orchestrator
®
4.0 and 4.5 Best Practices Guide
95