Help with FMCOMPACT

[mhicks]

I ran the FMcompact to reduce my policy database size. I did everything in the instructions before running the fmcompact. After running fmcompact the Event viewer on the CSPM server has fatal error. When I access the ondemand reports through my browser all of the signature categories are gone.

Interesting thing is that when I use the CSPM through a remote PC the event viewer works fine. Any suggestions?

[dlac455]

I can only comiserate with you. I had the same problem, opened a TAC case, and ended up re-installing CSPM due to time constraints. For the Cisco people watching: it was C173143. Good luck.

[mhicks]

I did the same thing. I had to reinstall the CSPM also. Is this one of the undocumented enhacements of CISCO?

[bernhard]

There are two files that the CSPM event viewer uses that get destroyed by fmcompact. The file "event-format.txt" and "sig.data". If you use fmcompact, move these files out of the way and replace them after fmcompact. The ...\Backup\database_0 directory should have copies of these files. The sig.data file contains signature update information so if you use the backup file, then the signature level will revert back to the your version that you installed. Just do a signature update to update sig.data.

You should also do a update file signatures off of the GUI's Help menu after restoring these files to tell CSPM that these files are not foriegn.