Why are there Interfaces labeled as "Unknown Interfaces" in the Admin->Alerts page of NFA and how can I get rid of them?

Document ID : KB000016974
Last Modified Date : 14/02/2018
Show Technical Document Details
Question:

Why are there Interfaces labeled as "Unknown Interfaces" in the Admin->Alerts page of NFA and how can I get rid of them?

Environment:
NFA All Versions
Answer:

When an Interface is deleted from NFA, it will mark any Alerts configured with those interfaces as "Unknown Interfaces".

 

If you want to cleanup the Alerts page, in order to get rid of the "Unknown Interfaces" you can run the command below on the NFA console:

mysql -D reporter -t -e "delete from trap_definitions where interfaceGroupid !=0 and interfaceid not in (select id from agents_all_view);"

 

If you want to get a list of recently deleted interfaces you can run the command below on the NFA console to generate a text file with a list of recently deleted interfaces:

mysql -D reporter -t -e "select * from agent_definitions_deleted;" > C:\deleted_interfaces.txt