Environment
Novell Sentinel 6.1 Correlation Engine
Novell Sentinel 6.0 Correlation Engine
Novell Sentinel 6.0 Correlation Engine
Situation
Within the Correlation Engine Manger the server shows up as unknown, if the server has already been removed from the environment. The Sentinel User Interface (UI) does not allow this entry to be removed currently.
Resolution
In order to remove the server from the view you must remove the entries from the database. The following steps are to be run as the 'esecdba' Sentinel user by the Database Administrator (DBA).
The entries specific to a Correlation Engine are located under 2 tables: "CORR_ENGINE_CONFIG"
and "CORR_DEPLOY_CONFIG"
To isolate the entry to be removed execute the following query:
SELECT CORR_ENGINE_CONFIG_ID, CORR_ENGINE_CONFIG_NAME FROM CORR_ENGINE_CONFIG; --Get the CORR_ENGINE_CONFIG_ID value of the engine along with its name.
If it has not be done already stop all of your Sentinel instances and make sure that all of the processes completely stop. The following queries are then used to remove the Correlation Engine ID.
DELETE FROM CORR_DEPLOY_CONFIG WHERE CORR_ENGINE_CONFIG_ID='<corr_engine_config_id from the first query>';
DELETE FROM CORR_ENGINE_CONFIG WHERE CORR_ENGINE_CONFIG_ID='<corr_engine_config_id from the first query>';
Rerunning the first SELECT query should then return the remaining Correlation Engine entries with the one entry removed.
After this is complete start Sentinel again and ensure that the entry is gone from the Correlation Engine Manager view.
The entries specific to a Correlation Engine are located under 2 tables: "CORR_ENGINE_CONFIG"
and "CORR_DEPLOY_CONFIG"
To isolate the entry to be removed execute the following query:
SELECT CORR_ENGINE_CONFIG_ID, CORR_ENGINE_CONFIG_NAME FROM CORR_ENGINE_CONFIG; --Get the CORR_ENGINE_CONFIG_ID value of the engine along with its name.
If it has not be done already stop all of your Sentinel instances and make sure that all of the processes completely stop. The following queries are then used to remove the Correlation Engine ID.
DELETE FROM CORR_DEPLOY_CONFIG WHERE CORR_ENGINE_CONFIG_ID='<corr_engine_config_id from the first query>';
DELETE FROM CORR_ENGINE_CONFIG WHERE CORR_ENGINE_CONFIG_ID='<corr_engine_config_id from the first query>';
Rerunning the first SELECT query should then return the remaining Correlation Engine entries with the one entry removed.
After this is complete start Sentinel again and ensure that the entry is gone from the Correlation Engine Manager view.