Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE

Feature Request - New Execute Command: 'Clear Active List'

Feature Request - New Execute Command: 'Clear Active List'

We have several uses cases that require the clearing of an Active List when "X" event occurs.

It would be nice if there was a command I could execute from a rule action to perform this.

7 Comments
Vini Acclaimed Contributor.
Acclaimed Contributor.

I think there should also be a poll for the least favorite thing. It is good to know the positive things but knowing the negative ones makes things improve.

Established Member.. Jorjjj
Established Member..

Agree! Interesting feature to have!

StevenvandeBraak Outstanding Contributor.
Outstanding Contributor.

That's  already possible if you create a package with an empty version of the list. Unzip the .arb and use the xml file as an input for the arcsight archive command:

/opt/arcsight/manager/bin/arcsight archive -f <emptyActiveList.xml> -u <arcsightUser> -m <ESMHostName> -p <password>


Honored Contributor.. wsladek1 Honored Contributor..
Honored Contributor..

This feature request is referring to an 'Action' within a rule.

StevenvandeBraak Outstanding Contributor.
Outstanding Contributor.

you can run any command within a rule action, so also the arcsight archive command clear the list using an empty version of the list

Honored Contributor.. wsladek1 Honored Contributor..
Honored Contributor..

I'm aware - I'm referring to a built in Action not a workaround bash script.  I think you're missing the point of this feature request.

davecoup1 Respected Contributor.
Respected Contributor.

I'd like to see this Action as well, but I think it needs to have a system event generated per entry as well.  the content I have wanted to see this used for would make use of counts, and/or expiration data where a TTL is not practical.  

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.