000030793 - Archer: Advice on Deleting Security Events on SecOps

Document created by RSA Customer Support Employee on Jun 14, 2016
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000030793
Applies ToRSA Product Set: Archer
RSA Product/Service Type: Archer
RSA Version/Condition: 5.5
Platform: Windows server 2008 R2
IssueThe issue happens on SecOps, the deleting of content of security event is hanged/stuck while processing, the security event has been set to retired, and the processing of the delete content has been at Step 62 of 89 for more than 9 hours.
CauseAs RCF is still forwarding alerts to SecOps applications after retiring it, we find the following error in JobFramework log:
Can't save content when module's status = Retired
ResolutionRefer to KB 000029797 to clean job_id from tblModuleJobStatus and tblJobStatus tables.
We need to suspend RSA Connector Framework service or alerts on SA before retiring any application in SecOps.
For more information about how to stop RCF or alerts on SA, please refer to the guide of SecOps or SA.