Captain
Captain
1132 views

Delete undeliverable notifications in ArcSight Express

Hello,

I have configured rule notification and selected
"acknowledge" checkbox on the rule action tab.

Initially customer received mail notification for
configured rules, now if I check the notification parameters under console,
there are many unacknowledged, undelivered notifications I am able to see.

Customer not receiving the mail notification, i want to
clear these cache notifications.

pls advise.

Regards,

SGS

0 Likes
6 Replies
Absent Member.. Absent Member..
Absent Member..

This is from an old ArcSight KB:

Question

How to delete all the notifications and their statuses from the database all at the same time?

Answer

If certain notifications are no longer needed, have become obsolete, or the number of them has become so large that it affects performance, you may want to delete all notifications at once.

Resolution:

Note: The following steps will permanently and irrevocably remove all existing notifications and their statuses from the database.

1. Stop the Manager Service.

2. Backup the system tables

3. Login to the Database Server as the arcsight user

3. At the SQL> prompt, execute the following commands:

delete from arc_notification_history;

delete from arc_notification_registry;

commit;


0 Likes
Captain
Captain


Hello farridem,

Thanks for the info, I am using ArcSight Express CORR Engine, is this applicable to AE as well?

Regards,

SGS

0 Likes
Absent Member.. Absent Member..
Absent Member..

Honestly can't answer that. We don't have any AE in our environment.

0 Likes
Absent Member.
Absent Member.

This worked for me in AE 3.0 and 4.0.

1.- /etc/init.d/arcsight_services stop manager

2.- cd /opt/arcsight/logger/current/arcsight/bin/

3.- ./mysql -u arcsight -p

4.- mysql> use arcsight;

5.- mysql> delete from arc_notification_history;     

6.- mysql> delete from arc_notification_registry;

7.- mysql> commit;

8.- /etc/init.d/arcsight_services start manager

A recommendation useful:

First identify the rule that is filling you with notifications and disable it.

0 Likes
Absent Member.
Absent Member.

Hi,

Would like to know the procedure to delete this for Arcsight Manager Version 6.0.0.1378.1.

Thank you.


Regards,

Ryan

0 Likes
Absent Member.
Absent Member.

Work Fine for:

Build versions:

        conapp:6.4.0.6711.2

        esm:6.1.0.1389.0(BE1389)

        storage:BL1124

        process management:4.0-1311

        installer:4.0-1311

So it should work for you too.

Regards,

Robinson

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.