Incidents stopped being created in Symantec Security Information Manager (SSIM)

Products

• Security Information Manager

Issue/Introduction

Correlation engine stopped generating incidents.

Cause

Sometimes, Incidents get corrupted.

Resolution

Before running this step make sure customer is aware that there will be data loss. The queue you remove can't be re-used later, there will be correlation loss of data.

1. Run the following commands:

Service icesvc stop
Service simserver stop

2. Go to /opt/Symantec/simserver/queues/ice/input

Delete all the queue files present

3. Go to /opt/Symantec/simserver/queues/ice/output

Delete all the queue files present

4. Run the following commands:

Service simserver start
Service icesvc start