FMC Broken Database

[heiko-buchter]

Unfortunately, neither Cisco nor our partner is able to assign the contracts to us, so I can't create TACs. Therefore, here in the forum:
We have a defective database in the FMC. Here's the error message:

[Mon Oct 20 11:50:12 2025][FATAL] [missing all columns] database [eventdb], table [si_categorysessionstats_byhour_1759708800_0], expected col
[Mon Oct 20 11:50:13 2025][INFO] [-] done checking EventDB tables (took 1 seconds)
After Checking DB, Warnings: 7, Fatal Errors: 1

Attempt to repair:

sudo repair_table.pl -farms si_categorysessionstats_byhour_1759708800_0

getting filenames from [/usr/local/sf/etc/db_updates/index]
getting filenames from [/usr/local/sf/etc/db_updates/base-7.6.2]
************ Applying dynamic update files ************
Dynamic update files directory: /usr/local/sf/etc/dynamic_db_updates
Applying file remove_ref_check_rna_ip_os_map.yaml.
Status: Success.
Applying file rule-comments.yaml.
Status: Success.
************ Applying dynamic update files finished ************

Processing table si_categorysessionstats_byhour_1759708800_0.
Checking for index file .....not found, attempting to recreate ....unable to re-create index file
Running mysqlcheck on si_categorysessionstats_byhour_1759708800_0
Failed to SHOW CREATE TABLE `si_categorysessionstats_byhour_1759708800_0`
Error: Table 'sfsnort.si_categorysessionstats_byhour_1759708800_0' doesn't exist
attempting mysqlcheck --repair
Failed to SHOW CREATE TABLE `si_categorysessionstats_byhour_1759708800_0`
Error: Table 'sfsnort.si_categorysessionstats_byhour_1759708800_0' doesn't exist
si_categorysessionstats_byhour_1759708800_0 is corrupted; repair is not possible

Has someone a solution?

[Aref Alsouqi]

I'm sorry, I don't have an answer to your question, however, if this is a virtual FMC and you have a backup copy then my recommendation would be to deploy a new one, restore the backup, and then assign it the same IP address as the old one.

[nspasov]

It will be tough for someone in the community to help with this one. TAC is the best option here so I suggest you press on your partner to resolve your support contract entitlement/s. You can also reach out to your Cisco account team to help you raise a TAC case.

Thank you for rating helpful posts!

[nspasov]

Thank you for rating helpful posts!

[Ajin5522]

This error points to a corrupted or partially missing EventDB table in FMC. The message “missing all columns” and the fact that MySQL cannot even SHOW CREATE TABLE means the table metadata itself is gone, not just an index. At this stage repair_table.pl and mysqlcheck can’t help because there’s nothing left for MySQL to repair. In FMC, EventDB tables are time-based and normally disposable, so the usual fix is to stop FMC services, drop the affected si_categorysessionstats_byhour_* table (or even rebuild the EventDB), and let FMC recreate it automatically. If the corruption is wider, a full EventDB rebuild or restore from backup is the safest path. Third-party tools like Stellar Repair for MySQL may help recover data if you absolutely need historical events, but they won’t fix FMC logic issues. Without TAC access, rebuilding the EventDB is typically the cleanest and safest resolution.

[Marvin Rhoads]

You did not mention if you have a backup. By default they would be stored in /var/sf/backups (although ideally they would be stored in remote storage). If you do, then the approach recommended by @Aref Alsouqi would be the way to go. It will be nearly impossible to manually recover the database otherwise. Even with TAC assistance, I would give it a low probability of success.

[Cristian Matei]

Hi,

    If you don't have a backup, try an FMC upgrade, it could potentially fix all problems for you; never tried to fix such cases with an upgrade, however, in your situation, I don't seen any other option and I would give it a try.

Thanks,

Cristian.