disable CSA flag movement

vincent.bonnard · ‎02-28-2007

Hello,

Is there a way to disable de movement of the red CSA flag when a deny rule applies? We would like to limit the interaction of CSA with the users, but still keep the GUI for query pop-ups.

Of course one way would be to disable logging for the deny rule, but we would like to continue to log these events for some deny rules.

The movement of the CSA flag generates unnecessary calls to our support team.

Thanks

tsteger1 · ‎02-28-2007

Delete the okclient.exe shortcut from the Documents and Settings\All Users\Start Menu\Programs\Startup folder.

This will keep the Agent UI from starting but users will still get a GUI popup for queries.

The downside is if they click no instead of yes for a legit action and their response is cached, you have to clear it from the console.

Tom

vincent.bonnard · ‎03-01-2007

Thanks for the reply. I didn't know this and it is an interesting option. I will consider it if I can't find anything else. But for the reason you mentionned I would prefer to leave the GUI on the desktop and just disable the flag movement. Isn't there a configuration file or reg entry where this could be changed?

Vincent

som-dc · ‎05-01-2007

The README.txt for 4.5.1.663 states this: "CSCeg87151 csa45-pilot: [ENH] Admin config for agent ui to disable flag waving " but I can't find how to accomplish it.

In the 5.2 release notes it states that it is currently and agent-side configuration that is being considered as a server-side feature in a future release.

But I can't find any documentation on the agent-side configuration.

tsteger1 · ‎05-01-2007

I founnd this for CSCeg87151

Workaround:

===========

CSA versions 5.0.0.187 has implemented a registry key that can be set to

disble flag waving on the receipt of an event.

1) Stopped the agent service

2) Add to the system's registry

DWORD:: //HKLM/SOFTWARE/Cisco/CSAgent/FlagFlapDuration

3) Exit the agent GUI from the system tray

4) Restart the agent service

5) Restart the agent GUI using the start menu.

Note: The agent will need to restart the agent GUI to pick up this change.

The agent GUI only reads these parameters on startup.

It worked for version 5.2 by leaving the default value at 0.

Tom