Delete Suppress

Updated: 21 May 2010 | 7 comments

bruthe

0 0 Votes

This issue has been solved. See solution.

Hi,

a user created many suppress of Yellow messages (like 160 000!!!) but only one was enough...
:-(

now I want delete these suppress.
when I select all suppress and I click delete, ESM is working like a dog!
2 days after, only 50 suppress was deleted!!!

Someone know an another way to delete these suppress more faster?

R.
Bruthe

discussion Filed Under:

Security, Enterprise Security Manager

Comments RSS Feed

Comments

Oct

2009

2 Votes 0

Vikram Kumar-SAV to SEP

Symantec Employee

Accredited

Try deleting in Smaller

Try deleting in Smaller chunks..

VMWARE-- SEP 12.1 vs McAfee vs Trend Micro

Oct

2009

0 Votes 0

Rupali Korde

Symantec Employee

Try this...

Hi,

Other than those 160000, Do you have other suppressions for this module, for that specific OS?

i.e. If you have account integrity module and you have created all these suppressions for WIN2003, you can delete the suppression file iteself. (PROVIDED you DO NOT have any other suppressions created for account integrity module for WIN2003).

If you have any other suppressions present, by deleting the file, you will lose them. Make sure you want to delete all the suppressions in that file.

Location: <INSTALLDIR>\system\<MACHINE_NAME>\db\suppress\<POLICYNAME>\<MODULENAME>\<OS>.dat

Do not edit the file manually, it may result in data corruption.

Please use this solution carefully.

Regards,
-Rupali

SOLUTION

Oct

2009

0 Votes 0

bruthe

Hi Rupali, Your solution

Hi Rupali,

Your solution looks pretty good but I can't find the file that must be deleted

my policy is "L3 (critique) SUN"
but in the folder <INSTALLDIR>\system\<MACHINE_NAME>\db\suppress\ the policyname are like this:
...
L3cr1517/
L3cr4137/
L3cr69af/
L3cr6f73/
L3crc1fb/
...

Question: How I can choose the correct policy name? and same question for module...

Thanks
bruthe

Oct

2009

0 Votes 0

Rupali Korde

Symantec Employee

Policy Folder - L3cr4137 You

Policy Folder - L3cr4137

You need to match the first 4 characters of the fodler with the module name.
e.g. Active directory - Acti****
Disk Quota - Disk****

These names are generated internally and used internally by ESM.

NOTE:
Before delting check the contents of the file, and check that the same suppressions which you want to delete are present in the file. AND Delete the file of the required OS platform only.

Regards,
-Rupali

Oct

2009

0 Votes 0

bruthe

Hi Rupali, how are you sure

Hi Rupali,

how are you sure that L3cd4137 is the policy folder for policy L3 (critique) SUN, I have many another policy like L3 (critique) ....

Thanks
Bruthe

Oct

2009

0 Votes 0

Rupali Korde

Symantec Employee

Hi Bruthe, You can create a

Hi Bruthe,

You can create a policy with the exact same name (case sensitive), and check the folder name created.
I did the same on my ESM manager, and for policy name
L3 (critique) SUN
the folder name generated was
L3cr4137

You can confirm the same on your ESM manager.

Regards,
-Rupali

Oct

2009

0 Votes 0

bruthe

Hi Rupali, It works, I

Hi Rupali,

It works, I removed the file <OS>.dat of my policy.
result: Suppress correctly remove after restarting the manager

Thanks
Bruthe

Delete Suppress

Comments

Try deleting in Smaller

Try this...

Hi Rupali, Your solution

Policy Folder - L3cr4137 You

Hi Rupali, how are you sure

Hi Bruthe, You can create a

Hi Rupali, It works, I

Would you like to reply?

Links

Technical Support

Symantec.com

Store

Community Stats