topic Re: I know it's false but how do I suppress bug 1250500 alert in Active IQ Unified Manager Discussions

I know it's false but how do I suppress bug 1250500 alert

Mark_D — Thu, 05 Dec 2024 17:47:29 GMT

After a lot of back-and-forth, I finally got all the alerts for NTAP & other vulnerabilities to go away. However, I cannot suppress the "bug 1250500" alert. There's a KB what says it's a false alert & can be ignored.

However, it keeps triggering tickets in our system via the SNMP link I need to get rid of the tickets.

Any way to filter this either at the array itself or via AIQUM?

-Mark

Re: I know it's false but how do I suppress bug 1250500 alert

paul_stejskal — Fri, 06 Dec 2024 05:47:59 GMT

I think it's fixed in AIQUM 9.14.1. Can you try upgrading?

Re: I know it's false but how do I suppress bug 1250500 alert

Mark_D — Fri, 06 Dec 2024 16:11:13 GMT

I'm at v9.16RC1 at this time. I had a number of these but once I crawled all the events and alerts from the arrays & acknowledged & resolved them, they went away. This alert is in the upper left corner of the node screen and I don't seem to have a way to ACK it.

Re: I know it's false but how do I suppress bug 1250500 alert

liu — Mon, 09 Dec 2024 08:24:14 GMT

You can disable the generation of these events in AIQUM, as you can see in this KB

Enabling and disabling Active IQ event reporting

This bug can be ignored

Re: I know it's false but how do I suppress bug 1250500 alert

Mark_D — Mon, 09 Dec 2024 15:19:45 GMT

I don't want to disable them all, just this one.

Re: I know it's false but how do I suppress bug 1250500 alert

paul_stejskal — Mon, 09 Dec 2024 16:10:55 GMT

I hate to say it but I'd open a case. I have no idea. Unless @binder has an idea?

Re: I know it's false but how do I suppress bug 1250500 alert

binder — Mon, 09 Dec 2024 16:30:35 GMT

Sounds like
https://kb.netapp.com/data-mgmt/AIQUM/AIQUM_Kbs/ActiveIQ_Unified_Manager_triggers_outdated_security_events_for_ONTAP_9.10_and_above_clusters

There was an issue in the rules with the version check where it was only checking 9.x and not 9.xx when comparing the Ontap version numbers so it treated 9.10 and 9.1 as the same.

The corrective action is to update the AIQ rules for Unified Manager. Sometimes this requires manually updating them.

https://kb.netapp.com/data-mgmt/AIQUM/AIQUM_Kbs/How_to_update_AIQCASecure_rules_manually_in_Active_IQ_Unified_Manager

They can be manually downloaded here.

https://mysupport.netapp.com/api/content-service/staticcontents/content/public/tools/unifiedmanager/ca/secure_rules.zip