Deleting unknown service alerts in one shot

[venkitesh]

hi all,

i have around 400 unknown service alerts. is there any way we can delete all unknown alerts in one shot from backend or something.

Please help.

[jdalrymple]

You mean services, correct, not necessarily "service alerts"?

This would require writing a custom database query to do it, and you would have to find some commonality between those services or a list that could be referenced. If you choose to go that route you'll definitely want good backups before you start.

[venkitesh]

hi

yes i mean services only.

All alerts are related to wmi access.

UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.

any idea about the query.

[abrist]

Well, if you want to remove the actual service checks, and if they are all named relatively the same, you could just search for them in the ccm and remove them in bulk with the "with checked" option.

If you are just trying to clear the alerts, you can do so with the mass acknowledge component.

[jdalrymple]

Is there a reason you cannot do this from the Services section of the CCM? Just check all of the services you want removed and choose "Delete" from the With Checked box at the bottom?

Munging with the database is highly unrecommended, it is not a simple schema and deleting services that way can cause unpredictable outcomes.