IPS sigs with no MARS event type?

Answered Question
Apr 15th, 2008
User Badges:
  • Blue, 1500 points or more

What is with the new IDS alarms in MARS that are mapping to blank event types (or at least appear blank)? Has anyone else noticed this? see attached incident and raw message. This has been going on for weeks now.



Correct Answer by orbyn about 9 years 1 month ago

I am seeing the same thing. Check out CSCso69721. No fix or workaround is available yet from what I can see.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Correct Answer
orbyn Fri, 04/18/2008 - 12:18
User Badges:

I am seeing the same thing. Check out CSCso69721. No fix or workaround is available yet from what I can see.


mhellman Fri, 04/18/2008 - 13:38
User Badges:
  • Blue, 1500 points or more

Thanks. Only Cisco would have the cojones to call such a failure in a SIM "cosmetic".

-sigh-

wiluszm Sat, 04/19/2008 - 13:54
User Badges:
  • Bronze, 100 points or more

Uggh... I feel your pain. We have events firing like this as well. At first it caused our custom mailer program to bomb out as the XML branches were blank. Lattest patch does not fix the issues. I consider this *far* from simply cosmetic.


-Mike

http://cs-mars.blogspot.com

Actions

This Discussion