Open-AudIT • View topic - [solved] Cannot acknowledge more than 1000 alerts.

View unanswered posts | View active topics

Board index » Open-AudIT » Discussion

All times are UTC + 10 hours

[solved] Cannot acknowledge more than 1000 alerts.

Page 1 of 1

[ 3 posts ]

Print view

Previous topic | Next topic

Author

Message

hsmalley

Post subject: [solved] Cannot acknowledge more than 1000 alerts.

Posted: Wed May 01, 2013 5:11 am

Newbie

Joined: Wed Jan 30, 2008 6:17 am
Posts: 28

[s]I'm running open audit beta 9 on Ubuntu 12.04.02 with 1GB of memory. I have php.ini set to 1GB memory usage too. Whenever I try to acknowledge more than 1000 alerts I get an http 500 error. I'm guessing this has to do with php memory limits. Anyone have any ideas on how to work past that besides just manually selecting a few hundred alerts at a time?[/s]

Never mind I figured it out... I needed to change this line in the php.ini

[code]; How many GET/POST/COOKIE input variables may be accepted
max_input_vars = 3000[/code]

Also I would like a know if there is a way to mass acknowledge alerts via MYSQL. This would save me time when I deploy updates to systems on my network.

Thanks!

Top

Mark

Post subject: Re: [solved] Cannot acknowledge more than 1000 alerts.

Posted: Wed May 01, 2013 9:13 am

Site Admin

Joined: Mon Jun 07, 2004 11:48 am
Posts: 1964
Location: Brisbane, Australia

[quote="hsmalley"]Also I would like a know if there is a way to mass acknowledge alerts via MYSQL. This would save me time when I deploy updates to systems on my network.

Active the Alerts Report (or one of the other specific Alerts reports).
Admin -> Reports -> Activate Report.
Open any Group and run the Report. You should be able to select the checkbox in the table header and click the Acknowledge button.
Done :-)

_________________
Support and Development hours available from [url=https://opmantek.com]Opmantek[/url].
Please consider a purchase to help make Open-AudIT better for everyone.

Top

aylnews

Post subject: Re: [solved] Cannot acknowledge more than 1000 alerts.

Posted: Tue May 21, 2013 6:14 pm

Newbie

Joined: Wed Jun 15, 2011 1:12 am
Posts: 30

I too seem to be having a spot of bother acknowledging alerts. I have seen 2 different errors appear. If I acknowledge a large number of alerts, in this case 8026 I get the following error:-

[quote]Fatal error: Call to undefined method Report::list_alerts() in /usr/share/OAv2/code_igniter/application/controllers/report.php on line 31

Once I click the Acknowledge button the number of alerts changes to 999 and then I pick "Standard Change" and on clicking submit I get the above error.

Do I need to add the line that hsmalley suggests? If so, what value should I set this to, as the 8026 alerts are just for my 2 Domain Controllers. I have just had a look and my Alerts (All devices) returns 279758 results

[code]; How many GET/POST/COOKIE input variables may be accepted
max_input_vars = 3000[/code]
I have checked my php.ini and this variable does not exist

If I acknowledge a smaller number of alerts, in this second case only 611 I get the attached message. It does seem however, in the second case, to have acknowledged the alerts.

Attachments:

File comment: Alert Acknowledgement message

alert ack error.png [ 7.38 KiB | Viewed 3806 times ]

Top

Page 1 of 1

[ 3 posts ]

Board index » Open-AudIT » Discussion

All times are UTC + 10 hours

Who is online

Users browsing this forum: No registered users and 2 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum