cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 1 of 4

Problems to remove recipient on ESM

Jump to solution

When i Tried remove an e-mail from recipients the ESM give me the erro message:

"One or more of the selected email addresses is currently in use and cannot be deleted. (ER1244)"

I researched at all possible sources without success.

I also tried by removing the recipient in all alarms and reports but even so its was not possible.

ErrorRecipientEsm.PNG

1 Solution

Accepted Solutions
penoffd
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 4

Re: Problems to remove recipient on ESM

Jump to solution

I ended up opening a ticket for this when I encountered it on our SIEM.  I believe in our case there was a user or users that were still connected to reports in the system and they had to be removed from them before their accounts could be deleted.

Here is what I did as directed by McAfee:

You will have to manually remove the email from the alarm/report that it is attached to. However we do have a way to figure out what reports/alarms the email is attached to. Follow these instructions to get the information

connect to esm database:

cd /usr/local/ess/data

nsql connect_esm.sql

once connected run:

select * from emailaddress - get the id(second column) associated to user's email

select * from notifica where emailaddressid= - get the id(fourth column) of notification

select * from notifctn where id= - will return report/alarm information including the name

This allowed us to identify the reports and then go in and remove the account from them.  On one of them I couldn't do it, so I copied the report and deleted the original.  That made the ESM happy and I was able to delete the account after that.

Dan

View solution in original post

3 Replies
penoffd
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 4

Re: Problems to remove recipient on ESM

Jump to solution

I ended up opening a ticket for this when I encountered it on our SIEM.  I believe in our case there was a user or users that were still connected to reports in the system and they had to be removed from them before their accounts could be deleted.

Here is what I did as directed by McAfee:

You will have to manually remove the email from the alarm/report that it is attached to. However we do have a way to figure out what reports/alarms the email is attached to. Follow these instructions to get the information

connect to esm database:

cd /usr/local/ess/data

nsql connect_esm.sql

once connected run:

select * from emailaddress - get the id(second column) associated to user's email

select * from notifica where emailaddressid= - get the id(fourth column) of notification

select * from notifctn where id= - will return report/alarm information including the name

This allowed us to identify the reports and then go in and remove the account from them.  On one of them I couldn't do it, so I copied the report and deleted the original.  That made the ESM happy and I was able to delete the account after that.

Dan

Former Member
Not applicable
Report Inappropriate Content
Message 3 of 4

Re: Problems to remove recipient on ESM

Jump to solution

Perfect guy!

Thank you so much for your help!

Marcus21
Level 7
Report Inappropriate Content
Message 4 of 4

Re: Problems to remove recipient on ESM

Jump to solution

I do not see a report or alarm name...do you?

 

--> 1 rows generated!
--> Row, Notification.ID, Notification.Name, Notification.ConditionID, Notification.Note, Notification.Filters, Notification.NotificationType, Notification.DoNow, Notification.AutoRunDisabled, Notification.AssigneeID, Notification.AssigneeType, Notification.EscAssigneeID, Notification.EscAssigneeType, Notification.EscSeverity, Notification.Severity, Notification.TimezoneID, Notification.EscEnabled, Notification.EscMin, Notification.DateFormat, Notification.SummaryTemplate, Notification.Hidden, Notification.Origin
--> 1, 70, Server Failed Login, 58, BLOB(0)

 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community