2 Replies Latest reply on Sep 10, 2015 2:49 PM by fnogueira

    Problems to remove recipient on ESM


      When i Tried remove an e-mail from recipients the ESM give me the erro message:


      "One or more of the selected email addresses is currently in use and cannot be deleted. (ER1244)"


      I researched at all possible sources without success.


      I also tried by removing the recipient in all alarms and reports but even so its was not possible.



        • 1. Re: Problems to remove recipient on ESM

          I ended up opening a ticket for this when I encountered it on our SIEM.  I believe in our case there was a user or users that were still connected to reports in the system and they had to be removed from them before their accounts could be deleted.


          Here is what I did as directed by McAfee:



          You will have to manually remove the email from the alarm/report that it is attached to. However we do have a way to figure out what reports/alarms the email is attached to. Follow these instructions to get the information


          connect to esm database:


          cd /usr/local/ess/data


          nsql connect_esm.sql


          once connected run:


          select * from emailaddress - get the id(second column) associated to user's email


          select * from notifica where emailaddressid= - get the id(fourth column) of notification


          select * from notifctn where id= - will return report/alarm information including the name



          This allowed us to identify the reports and then go in and remove the account from them.  On one of them I couldn't do it, so I copied the report and deleted the original.  That made the ESM happy and I was able to delete the account after that.



          • 2. Re: Problems to remove recipient on ESM

            Perfect guy!


            Thank you so much for your help!