search cancel

Removing Custom Log Field in Reporter

book

Article ID: 253377

calendar_today

Updated On:

Products

Management Center Reporter-VA Reporter Reporter-S500 Management Center - VA

Issue/Introduction

Once a custom log field is added to a database, the custom log field cannot be removed from database.   Hence, deleting the database or databases would be needed to remove the said Custom Log Field.  

This article is guidance how to remove log source, database and Custom Log field.  

Environment

Management Center and Reporter running supported version

Resolution

  - Using RPAC (Reporter Admin Console) in Management Center, unload and delete database/s on your Reporter.

Note: Once database is unloaded, click the delete    / trashcan icon.  This should delete the database and the log source associated to the database.   

 

- Access the Reporter's CLI.  This can be done via Management Center CLI shell or using ssh application (e.g. putty).  

- stop-reporter service

e.g.

reporter# stop-reporter 
Are you sure? (y/N): y
Reporter stopped.

- edit the dbfields.cfg

e.g.

reporter# edit-settings edit dbfields.cfg  

Note: Reporter uses VIM text editor - please refer to VIM documentation if needed.

- Remove the custom fields previously added 

The last two lines should show

 } # cs_threat_risk
} # dbfields

VIM Tip/Tricks:

*type / to search for the field name, click Return on your keyboard once to jump to the first occurrence, click n to go to the next occurrence (e.g. / # cs_threat_risk)
*once you find the section for the user-created variable (_u), use dd to cut each line of that block
*type /set nu to show line numbering

- write (save) and quit from VIM (e.g. keyboard sequence > 'esc : w q !  (without quotes).  

- commit the changes made to dbfields.cfg

e.g.

reporter# edit-settings commit dbfields.cfg

- start reporter

 

Additional Information

NOTE:   After you restart the Reporter service, the Reporter CLI displays lines as various processes start up. If any lines contain ERRO as part of the code, a configuration error occurred. Review the files you edited and rectify the errors. Furthermore, if you perform and commit edits and attempt to access the Reporter Management Console or via MC / RPAC but it is unresponsive, you likely committed erroneous syntax.  If the reporter-status shows failed or inactive, Reporter may show an "unknown error" in Management Center

 

*type /Forward to search for the field name, click Return on your keyboard once to jump to the first occurrence, click n to go to the next occurrence *once you find the section for the user-created variable (_u), use dd to cut each line of that block

Attachments