Technical Tip: How to clear the baseline profile database
| Description | This article describes how to clear the baseline profile database. |
| Scope | FortiSIEM. |
| Solution | Incidents raised with names like 'Sudden increase...' or 'Sudden decrease...' are defined by baseline rules. Those rules trigger statistics that are stored in a profile database and the changes are noticed along with the usual behaviors. Those stats may need to be cleared to avoid wrong or inconsistent rule triggering.
To clear the baseline profile database, run the next commands from super CLI as root: cd /opt/phoenix/cache rm profile.db rm daily.db phtools --stop phReportMaster
After those commands, the profiles are cleared and restarted to create fresh statics. |
