000026500 - How to delete all alerts on an RSA Security Analytics ESA appliance similar to performing a data reset on a core appliance

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000026500
Applies ToRSA Security Analytics
RSA Security Analytics 10.3
RSA Security Analytics Event Stream Analysis
IssueHow to delete all alerts on an RSA Security Analytics ESA appliance similar to performing a data reset on a core appliance.
Is it possible to do a data rest on my Event Stream Analysis (ESA) appliance in Security Analytics?
How can I quickly remove all alerts on my ESA device?
Resolution

Although a data reset cannot be performed on an ESA appliance as with the core appliances (i.e. decoder, concentrator, broker, etc.), the ESA appliance stores all of its alerts in a local PostgreSQL database, with the tables containing the alerts being stored in the following format:  alertYYYYMMDD.


To drop the tables that contain the alerts, follow the steps below.


  1. Connect to the ESA appliance via SSH.
  2. Access the ESA PostgreSQL database with the following command:  psql -U esa -h localhost
  3. Enter esa as the password and press enter.
  4. List all of the available tables with the following command:  \d+ alert
  5. Look for all of the tables with the format alertYYYYMMDD and delete them all with the following command:  drop table <table_name>;
    CAUTON!  You should only drop the child tables with the alertYYYYMMDD format.  Do NOT drop the master esa.alert table.
  6. Repeat step 5 for all other alerts that are to be removed.
  7. Issue the following command to exit the PostgreSQL database:  \q

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

Notes

See the screenshot below for an example of the alert removal procedure on an ESA appliance.


Legacy Article IDa66531

Attachments

    Outcomes