delete suppression via esmc

Article:TECH179459  |  Created: 2012-01-20  |  Updated: 2013-08-20  |  Article URL http://www.symantec.com/docs/TECH179459
Article Type
Technical Solution


Environment

Issue



Problems to delete suppression(s) via esmc commandline


Error



"No suppression with the same message, name, info and agent combination exists"


Environment



esmc console


Cause



You will need to check for exact parameters that you have to use to delete a specific suppression.
All parameters that are set (<> * or (all)) of following type:
-k   :   Message Code
-n   :   Name
-i   :   Info
-a   :   Agent
needs to be set in the delete statement.

delete suppression  [-k <msg_code>] [-n <name>] [-i <info>] [-a <agent>] <policy_name> <module_name> <os_type>

 


Solution



Example:

You would like to delete a suppression for a specific agent called "testagent.mydomain.my".

Verify which fields are populated:

esm> show suppression -a "testagent.mydomain.my" -l
Suppression #1
  Policy: test
  Module: Network Integrity
  Operating System: WIN2003
  Message Code: (all)
  Name: 1026 TCP
  Info: PID: 1620, Process Name: inetinfo.exe
  Agent: testagent.mydomain.my
...

To delete this specific suppression use:

esm> delete suppression -n "1026 TCP" -i "PID: 1620, Process Name: inetinfo.exe" -a "testagent.mydomain.my" "test" "Network Integrity" "WIN2003"

As Message Code is not specified: (all), it is not used in delete statement (no -k switch).

   



Article URL http://www.symantec.com/docs/TECH179459


Terms of use for this information are found in Legal Notices