PM 10 can't delete alerts

Continuing a thread from teh old boards. I have been having slow connection to the PM10 server. The PMC is on the same network as the server. all gig connectiuons. one thing I noticed was the abiity to delete alerts was taken away. I then question why you would acknowledge an lert that will be displayed until the alert view (mine set to 30) passes???? anyway I got a process that if you mess it up will break your database from tech support on how to delete the alerts from the database. I find the whole procedure unacceptable. Why go through all of this. It is thier suggestion that my loading up and use of PM10 may be slow because I have 1000 alerts that I can't get rid of under the alerts tab. Here is the procedure from the email they sent me. I think it is ridiculas that they would advise such a thing. I can't tell you how many times I will get a system that throws out hundreds if not thousands of alerts because F-Secure can't deal with a malware that keeps respawining it self or I get the "no scanners available" a couple thousand times filling up the log. I am a small shop with 5500 desktops. I can't live oin the policy manager and monitor it all day. And don't get me started on how bad the anti malware / spyware product is. It is useless. More often than not I use the free Malwarebytes program to clean a system the F-Secure let get infected and then can't remove the proble. Malwarebytes is almost always 99 percent succsseful. I only bring up the maleware issue because often my alerts are full of alerts about spyware the F-Secure could not deal with.


Dear John,


Thank you for contacting F-Secure.


It might be the increasing amount of alerts are causing the slowness. The only way to remove alerts in Policy Manager 10 is delete them directly from H2 database, however the following steps are for your reference only, we are not responsible for any unwanted SQL actions done in the H2 Database:


To get access to the H2 Database Console you have to:

 Enable H2 Database Console - set 'h2ConsoleEnabled' java property to 'true'


To Do this:

-Stop poliy manager server service

-Open registry and Proceed to HKEY_LOCAL_MACHINE\SOFTWARE\Data Fellows\F-Secure\Management Server 5

-Include -Dh2ConsoleEnabled=true in the value data for additional_java_args

-Restart F-Secure Policy Manager Server service for the change to be taking effect



Click on a shortcut to the H2 Database Console on a Policy Manager Server welcome page.


To Do this:

Go to start--policy manager--status monitor. Check your administration module port number. The default is 8080.

Example on the browser go to  and hit enter. You should able to see a link called "H2 Console". Click on that link and will take you the H2 Database Console.


To Delete the Alerts


You need to use the SQL delete the entry. You can just copy and paste the below command and click on "Run Ctrl+Enter" button :



you can create a script to move the alerts to a temporary location then delete the alerts:


CALL CSVWRITE ('c:/temp/alerts.csv', 'SELECT oid, severity, time, message_params, non_localized_message, host_identity, user_name, trap_count, ack FROM alerts JOIN oid_dictionary ON = alerts.oid_id JOIN domain_tree ON = alerts.domain_id', 'UTF-8', ';');





To delete the alerts here's the command:





Accepted Answer


  • MJ-perCompMJ-perComp Posts: 1,101 Superuser

    Hi John,


    The size of your installation idicates a few things to me


    1) You should rather ask for a SE to optimize your setup.

    2) What are your communication intervals for FSMA and FSAUA nither should be shorter than 1 hour with 5000 seats!

    3) What do you mean with "small shop"?  do you have 5000 small installations or 1000 with 5 desktops each or what does you environment look like?




  • mrfusionmrfusion Posts: 7


    i have the same problem. A lot of alerts from the same machine (about 2000 in a few hours, because the Av can't remove the virus).

    The real problem is not the large amount of alert, but the incorrect report that we produce periodically for our customers.


    I think that a small utility for selective deleting (and maybe for a selective reporting) will be great. Smiley Wink


    I apologize for my bad english.

  • anvarijanvarij Posts: 15

    So now they are offering to delete the alerts for me if I zip up my H2 and send it to them. This support call just gets more absurd as it goes on. What I mean by small shop is the amount of people we have on staff to service 24 buildings (small school system) 17500 students, almost 6000 desktops and 2500 staff. as for the speed. My real issue is that sometimes it takes up to 2 to 3 min to launch and other times under a min.  to startup the PMC. I have changed the launcher file to increase the vales of Xms256M and Xmx1024M. are there other tune up tricks? I also increased my polling time to 1 day from 10min. So when I am actually in the program now it is reponsive. Server is a vmware dual core 64bit 2008r2 with 6 gig. when starting the PMC the server shows java.exe *32 taking up anywhere from 50 to 80 percent of CPU.Once the console is up it drops to 0 - 2 perscent.To be honest since I first opened the call I have gotten it to the point where I can deal with it. But this absurd issue with Alerts really has me **&^%^& off. I am only stringing them along on the issue because of the absurd suggestions by tech support. If any moderator on this board has any communication line with the developers please ask them to put the delete alerts back and let us decide what to do with them. As I stated earlier what is the sense of acknowleding an alert that will never go away.As the other user stated in his post sometimes a machine can throw off thousands of alerts. what are we to do when tech support says your alerts count is high and that is why the PMC is slow?

  • DmitriyDmitriy Posts: 212 F-Secure Employee



    I don't think that the big number of alerts in the database make the PM Console slow. As you say, sometimes it takes up to 3 mins to start, other times it takes less than a min. There is probably something else in your config that affects PMC startup time. Please post here your SR ID and I will follow it up with the development team.





  • StephanStephan Posts: 351



    In addition to Dmitriys post: I would advise to not publish the SR ID but rather send it as private message.


    Best regards,

  • anvarijanvarij Posts: 15

    How do you send a private message through the boards?

  • MJ-perCompMJ-perComp Posts: 1,101 Superuser

    click on the name of the person you want to PM, then choose to send a message.



  • anvarijanvarij Posts: 15

    Sorry for the late reply. My case got escalated so at least now I am not getting the canned responses. here is the response.


    Actually I don't think that it is the number of alerts
    that is causing the PMC to slow down, at least not in your case with only 1000++
    alerts. Anyway, I do understand your point regarding the increasing number of
    alerts since delete functions are removed from PM 10. The reason it was removed
    from PM 10 is due to the change whereby web reporting is relying on the alerts,
    deleting the alerts would be causing web reporting database to be broken.


    Anyway, our R & D team is considering to
    develop a tool in deleting the alerts instead of doing that manually, since it
    is risky and a simple mistake could cause H2DB to be unrepairable.

  • anvarijanvarij Posts: 15

    Just did.

  • DmitriyDmitriy Posts: 212 F-Secure Employee

    Alright. Indeed, we consider making a tool to delete alerts from PM database. We will make a post here when it is available.

  • anvarijanvarij Posts: 15

    Great. Thanks.

  • mrfusionmrfusion Posts: 7
    Hi, any news about the tool? i have about 110.000 alert to delete.. :)
  • PeterPeter Posts: 186 F-Secure Product Expert




    Unfortunately as quite a few people are on currently on vacation, a similar tool is still not available. Rest assured, once it becomes available, the F-Secure Community will be first notified Smiley Happy

  • Hi


    do you have any news? :)


    i need to delete a lot of duplicate alerts

  • PeterPeter Posts: 186 F-Secure Product Expert


    We are finalizing the utility, your patience is appreciated.


  • PeterPeter Posts: 186 F-Secure Product Expert


    The Alert removal tool is now available, downloads are here:





    Readme file containing instructions is attached to this post.

    Also opened a new thread to provide feedback, comments or questions here:




This discussion has been closed.