Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

IEV database archiving does not work

Recently I installed the CSM 3.1 suite, which comes with IPS Event Viewer version 5.2(1.4).

I have set up the automatic archive feature to archive the IEV database daily at 23:45, but this doesn't work. I do get daily archive files with a size of 0 bytes. The realtime table isn't reset and contains all events collected by IEV so far.

I have looked into this problem a bit and the only indication that something is going wrong I found in the file C:\Program Files\CSCOpx\IPSEventViewer\IEV\log\system.log.

The message:

"Cannot execute MySQL query: insert into archive_table_20070521105454 select * from event_realtime_table where alarm_status='New' or alarm_status='Acknowledged' or alarm_status='Assigned' or alarm_status='Closed' because of error: Column count doesn't match value count at row 1" is logged.

Does anyone have any clues?

Cisco Employee

Re: IEV database archiving does not work

Please contact TAC for the appropriate patch. Regards.

Community Member

Re: IEV database archiving does not work

I have an open TAC case on this EXACT issue. Developers are still working on the patch. Also, check out this Field Notice:

FN - 62822 - Cisco Security Manager 3.1 - Software Removed

CreatePlease to create content