App Control: Script to Prune the Events: ''Error Processing host[hostId] ERROR_MESSAGE:Incorrect syntax near '-'''

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Thousand or millions of events: 

• Subtype: Server Error
• Description:

  Error Processing host[hostId] ERROR_MESSAGE:Incorrect syntax near '-'.

Environment

• App Control Server: 8.7 and Higher

Cause

Known issue in 8.7 App Control Server

Resolution

1. Login to the App Control database server
2. Confirm there is a recent full backup of the das database
3. Open a Support Ticket to Request prune_server_error_events.sql script
4. Stop the CB App Control Reporter and CB App Control Server services
5. Open SQL Mgmt Studio and run the prune script prune_server_error_events.sql
6. Start the CB App Control Reporter and CB App Control Server services

Additional Information

• It is recommending running the script after normal operating hours
• Script has some hardcoded parameters that could be changed (there are comments): hardcoded to run for 2 hours (@timeoutS = 7200), delete events in batches of 10k events