Today I have troubles to open alert details. I can open Threat Analyzer, list of alerts is displayed, but when I try "Show details" action on any alert, I got error: Alert unavailable.
Nevertheless I can acknowledge any alert in RTTA. Also all such alert trigers email notification and performs defined alert block action.
So the problem is only not showing alert details in any Threat analyzer (real-time and Historical)
Any idea please ?
This is a known issue with database tuning from the 7.5 manager. See the below KB:
A hotfix for the automatic tuning will be available soon.
Thank you gfergus1.
I missed this looking into 188.8.131.52 Issues list KB.
I disabled scheduled DB tuning as workaround. It works.
today I got some new alerts, but details is not available even I switched off DB tuning schedule as proposed in KB78036
Is there any other reason to details not working ?
There are other causes for the same issue, but the one mentioned above is the most common at 7.5.
The first step would be to run a dbtuning from the cli and see if it goes through cleanly. Check if that resolves the issue.
Check on the available disk space.
You can also check the indexes on the iv_alert table as indicated here: http://kc.mcafee.com/corporate/index?page=content&id=KB70907
Opening a support case would be recommended to help review log files (via infocollector) if you still have issues after checking these things.
there were lost some indexex on iv_alert table. I recovered from this by procedure described in KB70907.
Now alerts are displayed OK.
Big thx for help.