I have two different alerts rules exhibiting the same behavior once cleared.
The first being the ‘Palo Alto Networks passive firewall changed to active’ from the built in collection. Once a primary resumes operation, this alert remains.
The second similar one is a temperature based alert - once cleared it does not go away:
SELECT * FROM devices,sensors WHERE (devices.device_id = ? AND devices.device_id = sensors.device_id) AND sensors.sensor_class = “temperature” AND sensors.sensor_current >= 26
I’d be happy if I could figure out some sort of bash command to clear any and all active alerts but I can’t figure out how to do that either, or if its even possible but ideally these alerts would clear on their own.
Any ideas?.. there has got to be a way… help?