JSA might not generate offenses due to corruption of PGSQL DB. Doing a Hard/Soft Clean of the Security Event Management (SEM) from the WebUI does not clean the PostGres DB; would have to clean the PGSQL Data (clean SEM) from the CLI.

No Offenses in web UI.

Database corruption.

Follow the steps below to Clean SEM from the CLI:

Soft Clean SIM - Closes all offenses in the database.

1. Using the CLI, login as the root user
2. Stop the ECS service: # service ecs stop (For 7.3 and above use the command 'systemctl stop ecs-ep' and 'systemctl stop ecs-ec' )
3. Enter: psql -U qradar
   • begin;
   • select clean_sem_model_soft();
   • commit;
   • \q
4. Change directory: cd /store/mpc
5. Enter: rm -fr core
6. Enter: c d
7. Start the service:  service ecs start  (For 7.3 and above use the command 'systemctl start ecs-ep' and 'systemctl start ecs-ec')

Hard Clean SIM - Closes all active SIM data including offenses, targets, and attackers.

1. Using the CLI, login to STRM as root user
2. Stop the following services:
   • service hostcontext stop (For 7.3 and above use the command 'systemctl stop hostcontext')
   • service tomcat stop (For 7.3 and above use the command 'systemctl stop tomcat')
   • service imq stop (For 7.3 and above use the command 'systemctl stop imq')
3. Enter: psql –U qradar
   • s elect clean_sem_model();
   • \q
4. Change directory: cd /store/mpc
5. Enter: rm -fr core
6. Enter: cd
7. Restart the services:
   • service imq start (For 7.3 and above use the command 'systemctl start imq')
   • service tomcat start (For 7.3 and above use the command 'systemctl start tomcat')
   • service hostcontext start (For 7.3 and above use the command 'systemctl start hostcontext')

2019-11-30: Validated process in 7.3.2p2 code.