Notifications reset and housekeeping

[maged1]

- is there a way to clear the notification database kept by the ESM

to start over scratch .

-what would be the default esm process to recycle the notification database

or would it grow for ever ?

[rkent1]

There's a HP Support KB on this topic -> https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetsearch/document/KM1270476

, , what's the word on us copying stuff over from that KB store to P724?

[grace.chang]

! I've been working with the KB team and KB Manager and the plan is for him to move the top 25 KB articles by next week and each month, to update regularly with KB articles. We've been pulling metrics of what is most viewed/most useful for users and wanting the content to most applicable and up-to-date for the community. Great timing in asking and I'll be keeping the community updated once he's done migrating more of the content over.

[rkent1]

Awesome, good to know. I had started submitting feedback on those KB articles there, so it's good to know somebody is looking at them

[maged1]

1) Does the same command apply to Express Corr Engine :

delete from arc_notification_history;

delete from arc_notification_registry;

commit;

2) And how to connect to the database Corr Engine ?

[rkent1 · Accepted solution]

1. Address the root cause first - Identify the rule that caused the bulk of the notifications

2. Shut off the Manager Service:

• /etc/init.d/arcsight_services stop manager

3. Log into MySQL:

  · cd /opt/arcsight/logger/current/arcsight/bin/ 

• ./mysql -u arcsight –p

4. Delete Notifications:

• mysql> use arcsight;
• mysql> delete from arc_notification_history;
• mysql> delete from arc_notification_registry;
• mysql> commit;

5. Restart Manager Service

• /etc/init.d/arcsight_services start manager

[maged1]

Thanks a lot Richard ,

this is what i was looking for ,

Is there a default password for the database on the express appliance

or it should have been set during the  installation .

[maged1]

what happens to the accumulated notifications , if not manually cleaned ,

Do they apply same ruled of events archiving and retention

no matter the status of acknowledgment ?

[rkent1]

Good question! I would hope that they'd expire as well. Let me see what I can find out