03-02-2015 12:51 PM
I was wondering if the follow approach makes sense, or if it might cause some issues. I often find clients have a large number of alerts in Airwave, usually thousands. They usually don't care about them and want us to clean up their triggers so their Alerts are more informative.
Usually they want us to remove all the existing alerts. If you try to load a page of 500-1000 alerts and click acknowledge it can take several minutes for the page to load again. For some clients with thousands of alerts this could take a while to acknowledge all the alets.
I found another post which said you can delete all alerts using:
# dbc 'delete from alert;'
What i wanted was to acknowledge all alerts, but keep them in the system. To accomplish this i did:
airwave=> update alert set viewed = 1 where viewed = 0;
As far as i can tell the 'viewed' feild in this table equates to 'Acknowledged' in the AMP UI. Running this command removed all active alerts in the WebUI.
Is this a valid process to mass-acknowledge alerts, or is there some backend processes which might be missed doing it this way?
ACDX, ACCP, CISSP, CWNA
03-02-2015 02:30 PM
I would try to get an understanding of that first but I do see the need to acknowledge them. unfortunately I can't confirm what you wrote is correct or not. I believe there might be a script in the /scripts folder that does the exact same thing.
ACDX #420 | ACMP
[If you found my post helpful, please give kudos!]