Old smartevent csv report is still being generated and mailed even though it is no longer configured

[Agust]

Despite not having a smartevent report configured, specifically the Remote Access view, it is still generated and sent by mail, although they are sent empty.
As we can see in the image, there is no report configured at the moment.
Do you know of any other way that we can disable it?

[the_rock]

Was this separate SE server or part of mgmt server?

Andy

[Agust]

Hi Andy!
The SE server is part of the management.
In the management server we have the SE blade enabled and it is defined as correlation unit.

Thanks

[the_rock]

Sorry, maybe I misunderstood...I thought smart event itself was no longer needed, but guess thats not the case, you just do NOT want reports generated?

Andy

[Agust]

Hi Andy!
We want to continue to keep the Smartevent blade active.
Currently the scheduled report of the view you mentioned above is not configured, but despite not being configured it is still being generated and mailed.
We will try restarting the Smartevent service, but we believe it is a service failure.

Thanks

[the_rock]

For what its worth, I would say you can even reboot the mgmt server, that can be done pretty much any time.

Andy

[the_rock]

One thing you can try is evstop; evstart and test again.

Andy

[Amir_Senn · Accepted solution]

This is per server per admin. Are you looking with the same admin that created those scheduled views/reports?

[the_rock]

Great point!

[Agust]

Hello Amir!
How are you?
Thank you for your reply.
Do you know if there is a way to know which user the report is related to, in order to delete it?
We already checked in admin and another one, but we don't see it either.
Thank you.

[Amir_Senn]

Check the emails you receive.

It should have something like:

"The attached report is sent to you on behalf of <admin_name> using Check Point SmartEvent"

[the_rock]

Please let us know the outcome once its fixed.

Best,

Andy