How to clear huge number of events via CLI?

Hello,

I am not sure how to acknowledge all the events from CLI but it can be done from GUI.

Please try following steps to acknowledge system events:

1. In Avamar Administrator, click the Administration launcher button. The Administration window appears.
2. Click the Event Management tab.
3. Click the Unacknowledged Events tab near the bottom of the window.
4. Select one or more entries.

Press and hold the Shift key to select an entire range of entries; press and hold the Ctrl key to select several individual (noncontiguous) entries.

5.     Open the Actions menu and select Event Management > Acknowledge

Unacknowledged Events.

The selected events no longer appear in the list.

6.     (Optional) Select Actions > Event Management > Clear All Alerts to clear the entire

unacknowledged events list.

Regards,

Pawan Kumawat

This is the part of the process that’s hanging. When attempting to launch the Event Management screen, the large number of events causes the screen to hang. I never get to the list of events, and as such can’t select all and acknowledge all. It may eventually work given enough time, but I’ve let it run for several hours with no progress. Am hoping there’s a way to remove these events without using the GUI.

Thanks for your help!

Hey James,

I'm not sure whether can delete even via CLI. Below thread is for your reference. Hope this help to you.

How to delete events profiles via MCCLI

https://community.emc.com/message/679991

Hello James,

I would suggest to open service request with EMC support team.

I researched more on it and I am unable to find a way to delete events or alerts from CLI.

Regards,

Pawan Kumawat

Hello,

I found the MCCLI command syntax to acknowledge events, hope this will help you .

mccli event ack [--after=STRING] [--all=BOOLEAN(false)]

[--before=STRING] [--category=STRING] [--domain=STRING]

[--exclude=STRING] [--id=INTEGER] [--include=STRING]

[--range=STRING] [--severity=STRING] [--source=STRING]

[--type=STRING]

--after=STRING - Acknowledges events after a date. STRING must be in the format of: YYYY-MM-DD HH:mm:ss where YYYY is the four-digit year, MM is the two-digit calendar month, DD is the two-digit day of the month, and HH:mm:ss is a timestamp.

--all=BOOLEAN(false) -  Acknowledges all events.

--before=STRING  -         Acknowledges events before a date. STRING must be in the format of: YYYY-MM-DD HH:mm:ss where YYYY is the four-digit year, MM is the two-digit calendar month,

DD is the two-digit day of the month, and HH:mm:ss is a timestamp.

--category=STRING - Specifies the category of the events to acknowledge. STRING must be one of the following:

• APPLICATION

• SECURITY

• SYSTEM

• USER

--domain=STRING - Specifies the domain of the events to acknowledge.

--exclude=STRING - Comma-separated list of event codes to exclude from acknowledgement. The comma-separated list cannot contain spaces. The --include and --exclude options are mutually exclusive.

--id=INTEGER - Unique identifier of the event to acknowledge.

--include=STRING - Comma-separated list of event codes to include for acknowledgement. The comma-separated list cannot contain spaces.

The --include and --exclude options are mutually exclusive.

--range=STRING - Specifies a range of event IDs for the events to acknowledge. STRING must be in the format of: ID-1:ID-2 where ID-1 and ID-2 are the lower and upper limits of the range, respectively.

--severity=STRING - Specifies the severity of the events to acknowledge. STRING must be one of the following:

• NODE

• NODE_FATAL

• OK

• PROCESS

• PROCESS_FATAL

• SYSTEM_FATAL

• USER

• USER_FATAL

--source=STRING - Specifies a source storage location for the events to acknowledge, either:

• avamar

• dd

If you specify avamar, then the command acknowledges events for the Avamar server. If you specify dd, then the command acknowledges events for all configured Data Domain systems.

--type=STRING - Specifies the type of event to acknowledge. STRING must be one of the following:

• AUDIT

• DEBUG

• ERROR

• INFORMATION

• INTERNAL

• WARNING

Adam,

Thanks very much for your help. The mccli command was able to clear 42,000 events in about 60 seconds! Just what I needed. Thanks again.

Jim Dunbar

Thanks for your help Pawan. The mccli command was what I needed and cleared the 42,000 events. Appreciate your looking into this.

Jim Dunbar