topic Re: FMC Health Alert not clearable (Interface Status (Modified)) in Network Security

FMC Health Alert not clearable (Interface Status (Modified))

Legusol — Fri, 07 Jan 2022 21:55:11 GMT

We just upgrade to FMC v7.0.1 and afterwards we seeing an issue with a Health Alert that we cannot clear. The following is showing for one of our FTDs. At the interfaces shown are disabled interfaces on the FTD that are not in use which they should be since we don't use them. We cannot figure out how to clear this alert. If you click the alert, it takes us to the Health Monitoring page where both the FMC and FTD are showing Green without and alerts.

Prior to raising a TAC case I figured I check here.

Re: FMC Health Alert not clearable (Interface Status (Modified))

Marvin Rhoads — Sat, 08 Jan 2022 07:51:07 GMT

Here is the fix to delete the messages. The following commands need to be run as root from the FMC cli (expert mode):

OmniQuery.pl -db mdb -e "select status,category,hex(uuid),body from notification where status=11;"
OmniQuery.pl -db mdb -e 'delete from notification where uuid=unhex("<insert the uuid that the first command returns here>");'
OmniQuery.pl -db mdb -e "select status,category,hex(uuid),body from notification where status=11;"

repeat line 2 as necessary if there is more than one entry to be removed. The output after line 2 should be "Command returned no results." That is normal. Line 3 (same as line 1) should return "0 rows in set" if you removed the messages successfully.

The following bugID applies: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa14518
(internal only as of this writing since it is still under investigation with only a work around in place and not a proper fix)

Re: FMC Health Alert not clearable (Interface Status (Modified))

Legusol — Mon, 10 Jan 2022 17:01:22 GMT

Thank you! That worked perfectly!

Re: FMC Health Alert not clearable (Interface Status (Modified))

ste.ant — Wed, 23 Mar 2022 13:57:54 GMT

Worked with FMCv v6.7.0.3 as well! Thank you.

Re: FMC Health Alert not clearable (Interface Status (Modified))

Martin Ostberg — Fri, 01 Apr 2022 11:29:16 GMT

Running a newly installed 7.0.1 here and I'm getting this as well.

Running

OmniQuery.pl -db mdb -e "select status,category,hex(uuid),body from notification where status=11;"

Doesn't return any results though.

0 rows in set (0.000796 seconds)

Edit: my bad, I was in FTD, not FMC.

This worked!

Re: FMC Health Alert not clearable (Interface Status (Modified))

tjmann — Tue, 05 Apr 2022 20:11:04 GMT

Just worked for me. I had to remember to do a sudo SU first, which gives you root user access. Then run the commands.

Thank you

Re: FMC Health Alert not clearable (Interface Status (Modified))

mdelvecc — Thu, 16 Jun 2022 13:28:20 GMT

Hi Marvin,

I am running image 7.0.2-88 on my 4600 FMC, and tried running the commands you listed above. For some reason, they just won't clear. I ran all lines several times, but still display in notification window. It never returns a "0 rows" after running the 3rd line. Any other suggestions?

Thanks,

Mark

Re: FMC Health Alert not clearable (Interface Status (Modified))

Marvin Rhoads — Thu, 16 Jun 2022 13:33:27 GMT

@mdelvecc is your FMC in HA by chance? If so be sure to run the commands on the active FMC.

If it's stand alone, then you may have some other root cause and would need to open a TAC case for resolution.

Re: FMC Health Alert not clearable (Interface Status (Modified))

mdelvecc — Thu, 16 Jun 2022 13:53:33 GMT

Yes, I am running H/A pair, but ran it on the active. I see the table populated with the warnings, after I run the commands. I ran the same commands on the standby FMC and it returned "0 rows", which I would expect.

Re: FMC Health Alert not clearable (Interface Status (Modified))

Priit Kosmopoliit — Wed, 02 Nov 2022 07:33:09 GMT

The solution worked, but we are running FMC 7.1.0.1 (build 28) and in the bug tool it says:

Known Fixed Releases (2 of 2)

7.1.0

7.0.1

Which seems to be not true.

Re: FMC Health Alert not clearable (Interface Status (Modified))

longlong_liu — Fri, 12 May 2023 19:31:44 GMT

Hi,

I also encountered this bug, what I want to know is:

1: Is the interface displayed by the health alarm unavailable? (modified [eht1/13 , eth1/14 , eth1/15 , eth1/16] , even if the indicator lights are normal after I connect eth1/16, but there is no data interaction)

2: The following commands need to be run as root from the FMC cli (expert mode): How to enter root mode

3: After clearing the error message, whether the interface can be used normally.

Thank you very much!

Re: FMC Health Alert not clearable (Interface Status (Modified))

Marvin Rhoads — Mon, 15 May 2023 07:37:21 GMT

1. I was told by TAC that the bug has to do with the newer software parsing the MTU setting in the interface configuration where it did not do so before.

2. From clish (> prompt) type "expert" (without quotes). that will switch to the Linux shell as user admin. Then type "sudo su -" (also without quotes) to change to root user. The Linux prompt will change to #, indicating you are root user.

3. Yes.

Re: FMC Health Alert not clearable (Interface Status (Modified))

sammer.wehaib — Tue, 30 May 2023 16:42:17 GMT

Hi @Marvin Rhoads thanks for sharing a solution for this, I running those commands and I'm still seeing those warning, could you please have a look?

root@fmc:/Volume/home/admin# OmniQuery.pl -db mdb -e "select status,category,hex(uuid),body from notification where status=11;"
************ Applying dynamic update files ************
Dynamic update files directory: /usr/local/sf/etc/dynamic_db_updates
Applying file remove_ref_check_rna_ip_os_map.yaml.
Status: Success.
************ Applying dynamic update files finished ************
+--------+------------------------------------------------------+----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------+
| status | category | hex(uuid) | body |
+--------+------------------------------------------------------+----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------+
| 11 | health:category.qwerjyue-andv-7654-2345-g4678494gi94 | FF93C555564B3A4CA13B5C80A63DB8A2 | {"property":"task:category.99","literal":"Modified: [Ethernet1/5, Ethernet1/6, Ethernet1/7, Ethernet1/8]","arguments":{}} |
| 11 | health:category.qwerjyue-andv-7654-2345-g4678494gi94 | 5CDC6A8CB2D43D559E38A39B6A1D434F | {"arguments":{},"literal":"Modified: [Ethernet1/3, Ethernet1/4, Ethernet1/5, Ethernet1/6, Ethernet1/7, Ethernet1/8]","property":"task:category.99"} |
| 11 | health:category.qwerjyue-andv-7654-2345-g4678494gi94 | A5F93E573B113B2FA571DB9E52AACC7D | {"arguments":{},"literal":"Modified: [Ethernet1/3, Ethernet1/4, Ethernet1/5, Ethernet1/6, Ethernet1/7, Ethernet1/8]","property":"task:category.99"} |
+--------+------------------------------------------------------+----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------+
3 rows in set (0.000615 seconds)

root@fmc:/Volume/home/admin# OmniQuery.pl -db mdb -e 'delete from notification where uuid=unhex("<insert the uuid that the first command returns here>");'
************ Applying dynamic update files ************
Dynamic update files directory: /usr/local/sf/etc/dynamic_db_updates
Applying file remove_ref_check_rna_ip_os_map.yaml.
Status: Success.
************ Applying dynamic update files finished ************
Command returned no results.

Re: FMC Health Alert not clearable (Interface Status (Modified))

Marvin Rhoads — Tue, 30 May 2023 16:52:36 GMT

When you run:

OmniQuery.pl -db mdb -e 'delete from notification where uuid=unhex("<insert the uuid that the first command returns here>");'

...you must substitute your specific UUID(s) for the portion of that command within the quotes. For instance:

OmniQuery.pl -db mdb -e 'delete from notification where uuid=unhex("FF93C555564B3A4CA13B5C80A63DB8A2");'

...and so forth for each UUID that the query returned.

Re: FMC Health Alert not clearable (Interface Status (Modified))

sammer.wehaib — Tue, 30 May 2023 17:01:30 GMT

Thanks Marvin, worked like a charm, appreciate your always support and help.