IPS sigs with no MARS event type?

Answered Question
Apr 15th, 2008

What is with the new IDS alarms in MARS that are mapping to blank event types (or at least appear blank)? Has anyone else noticed this? see attached incident and raw message. This has been going on for weeks now.

I have this problem too.
0 votes
Correct Answer by orbyn about 8 years 7 months ago

I am seeing the same thing. Check out CSCso69721. No fix or workaround is available yet from what I can see.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Correct Answer
orbyn Fri, 04/18/2008 - 12:18

I am seeing the same thing. Check out CSCso69721. No fix or workaround is available yet from what I can see.

mhellman Fri, 04/18/2008 - 13:38

Thanks. Only Cisco would have the cojones to call such a failure in a SIM "cosmetic".

-sigh-

wiluszm Sat, 04/19/2008 - 13:54

Uggh... I feel your pain. We have events firing like this as well. At first it caused our custom mailer program to bomb out as the XML branches were blank. Lattest patch does not fix the issues. I consider this *far* from simply cosmetic.

-Mike

http://cs-mars.blogspot.com

Actions

This Discussion