Correlation Engine Server server shows up as unknown. Hot to remove a Correlation Engine from the Correlation Engine Manager

  • 7003387
  • 28-May-2009
  • 26-Apr-2012

Environment

Novell Sentinel 6.1 Correlation Engine
Novell Sentinel 6.0 Correlation Engine

Situation

Within the Correlation Engine Manger the server shows up as unknown, if the server has already been removed from the environment.  The Sentinel User Interface (UI) does not allow this entry to be removed currently.

Resolution

In order to remove the server from the view you must remove the entries from the database.  The following steps are to be run as the 'esecdba' Sentinel user by the Database Administrator (DBA).

The entries specific to a Correlation Engine are located under 2 tables:  "CORR_ENGINE_CONFIG"
and "CORR_DEPLOY_CONFIG"

To isolate the entry to be removed execute the following query:

SELECT CORR_ENGINE_CONFIG_ID, CORR_ENGINE_CONFIG_NAME FROM CORR_ENGINE_CONFIG; --Get the CORR_ENGINE_CONFIG_ID value of the engine along with its name.

If it has not be done already stop all of your Sentinel instances and make sure that all of the processes completely stop.  The following queries are then used to remove the Correlation Engine ID.

DELETE FROM  CORR_DEPLOY_CONFIG WHERE CORR_ENGINE_CONFIG_ID='<corr_engine_config_id from the first query>';

DELETE FROM CORR_ENGINE_CONFIG WHERE CORR_ENGINE_CONFIG_ID='<corr_engine_config_id from the first query>';

Rerunning the first SELECT query should then return the remaining Correlation Engine entries with the one entry removed.

After this is complete start Sentinel again and ensure that the entry is gone from the Correlation Engine Manager view.

Status

Reported to Engineering