ePO/ODBC Error - Conversion failed when converting date and/or time from character string

[RSAAdmin]

We recently upgraded to McAfee ePO 4.5. I have been working on getting the data to enVision for a couple of weeks, but without much luck. The error I see is (same error for epolicy_system and epolicy_virus):

%NIC-3-605128: ODBC, ODBC, -, -, -, -, Detail: 4624: epolicy_virus:EnVision:Extended DB error: Database error details: retcode=-1, sqlstate=22008, native_error=241, msg=[Microsoft][ODBC SQL Server Driver][SQL Server]Conversion failed when converting date and/or time from character string.

I believe the error is somewhere in the ODBC Types. I have them set up under ePolicy4.5 and ePolicyvirus4.5. I am not sure if these ODBC types were part of enVision with predefined fields, or if they have been modified.

I can run the SQL from the ODBC type directly on the database and successfully pull results if I leave the WHERE clauses out (see attachment).

I've attached the Data Queries and Max Tracking Queries. If more information would be helpful, let me know.

[RSAAdmin]

I didn't have any luck using the 4.5 ODBC sources, so I went back to 4.x. I have restarted the ODBC service. The data I get from McAfee all comes under an UNKNOWN device, which has been popping up for as long as we have has ePO set up in enVision. The data looks like it is all there, but enVision doesn't seem to recognize it. I looked at the data in Event Viewer, and compared that to some data I had saved from Event Viewer earlier this year for another issue. The only difference I see is that the earlier capture shows the IP addresses in regular format, whereas the IP addresses now are coming across as a 10-digit number. Is this a database problem, or is enVision doing (or not doing) somethng to cause this? Could this be the entire problem?

[RSAAdmin]

I ran out of time messing with this, so I completely removed the ePO server from enVision, reinstalled the latest ESU, and started over. I don't know where the problem was, but it's working now. I copied the orphaned data over to the new device and am rebuilding the indexes now.

We've had intermittent issues with this appliance over the past year or so (an HA running Windows 2000). RSA support has been great about helping us whever we have an issue, but I've spent too much time fixing things on it. We just got our new appliance in, and it will go into production as soon as we complete the migration plan and designate a place for it to reside in the data center.

[RSAAdmin]

I had this same problem you experienced back when EPO went from 3.5 to 4.0.   RSA didn't have support for 4.0 a year and a half after it had been out.  When we upgraded EPO to 4.0 without support for it in enVision (they got tired of waiting for me) the exact same thing happened.  It has to do with changes made by McAfee to the database table layout and schema of EPO.  RSA will likely provide an updated (now third) different kind of ODBC source type for EPO in order for this to work, so keep your eye out on the Event Source Updates for 4.5 support.  I know it's on its way.