4 Replies Latest reply on Feb 9, 2015 2:56 AM by gehinger

    Deleted rule still trigger in dashboard

    gehinger

      Hi all,

       

      I am working on ESM 9.4.2 and I come across a problem regarding correlation rules and dashboards.
      I created a correlation rule as a test few days ago and then I deleted it. My problem is that the rule still trigger in my dashboard with the name "0". If I ask to show the rule, i obtain an "Record not found (ER25)" message.

       

      I checked the rule in the default policy as well as in the correlation manager and it is deleted in both.

       

      Is it a bug or did I failed somewhere?

       

      Thank you in advance for any help
      Guillaume.

        • 1. Re: Deleted rule still trigger in dashboard
          aszotek

          Worth raising support ticket, seems unprobable to be expected behaviour.

          • 2. Re: Deleted rule still trigger in dashboard
            Scott Taschler

            The only other suggestion I'd have is to force a rollout of policy to your Correlation Engine.  It sounds like your rule has been deleted from the policy on your ESM, but the rule logic is still running on the CE.  Forcing a rollout of the updated policy should take care of the issue.

             

            Scott

            • 3. Re: Deleted rule still trigger in dashboard
              ryan.fitzpatrick

              Deleting a rule in the Policy Editor does not delete events associated with that rule. It only rips out the name matching and leaves the data in the database. Take for instance if someone deleted a rule for windows logon using explicit credentials, it would delete all authentication data on your ESM for windows events for a windows logon using explicit credentials.This way, the data is still in the database, still searchable, however the signature description of the rule is now gone due to having been deleted. If you do not wish to see the 0 associated with the name, you can select the events and delete the events.

               

              Also, if new events are still triggering, perform a policy roll out, the rules are initially stored in the ESM, then pushed to receivers during the rollout, if the receivers have not had the rules rolled out to them then they still have a copy of a rule where the name does not exist in the ESM now.

               

              Hopefully that helps.

              • 4. Re: Deleted rule still trigger in dashboard
                gehinger

                Hi Ryan.

                 

                Thanks for this clarification. It seams it was old events which continue to appear. Once deleted, the rule didn't pop up againin my dashboards .