Technical Tip: Devices remaining in maintenance mode after a scheduled maintenance period has ended

Description

This article describes the steps to take to resolve the issue of devices remaining in maintenance mode after a scheduled maintenance period has ended. The user may not receive incidents for these devices even after the maintenance period has expired.

Scope

FortiSIEM.

Solution

When in scheduled windows, there is no scheduled maintenance, but some devices in CMDB are still shown as scheduled.

It is possible to clean particular information to fix the issue, under:

• CMDB -> Devices.
• Admin -> Setup -> Maintenance.

The provided fix can be used in cases where there is only an old scheduled maintenance and not a currently ongoing one (which would require careful review of the tables).

To create a backup of CMDB:

pg_dump -U phoenix phoenixdb > phoenixdb.sql tar -czvf phoenixdb.tar.gz  phoenixdb.sql

To review the current data:

psql -U phoenix -d phoenixdb -c "SELECT * FROM ph_dev_maintenance;" psql -U phoenix -d phoenixdb -c "SELECT * FROM ph_dev_maintenance_status_mapping;" psql -U phoenix -d phoenixdb -c "SELECT * FROM ph_dev_maintenance_item;" psql -U phoenix -d phoenixdb -c "SELECT id, maintenance FROM ph_device where maintenance=1;" psql -U phoenix -d phoenixdb -c "SELECT id, maintenance FROM ph_device where maintenance=0;"

To clear the old entries:

TRUNCATE TABLE ph_dev_maintenance cascade; TRUNCATE TABLE ph_dev_maintenance_status_mapping cascade; TRUNCATE TABLE ph_dev_maintenance_item cascade;   UPDATE ph_device SET maintenance = null WHERE maintenance=1;  UPDATE ph_device SET maintenance = null WHERE maintenance=0;