Change/stop alerts that ciscoworks sends out

Unanswered Question
Apr 27th, 2010

Hi,

Im trying to find were in ciscoworks, i can adjust the sev levels of various devices.

For eg - i get this alert

Syslog message generated from device au-aapvpnxxx: Apr 28 10:48:01 10.x.x.x 73090715: 2010 Apr 28 12:56:10.310 +0900 +11:00 %HARDWAREMON-2-10: RPT=227329: Chassis intrusion alarm is inactive.

It comes up as sev 1-3.

I dont want this alerting, cause its only a chassis intrusion alarm.

What would be the best thing to do, stop this alert from emailing. ? ( were do you go to change this / stop it etc..)

Help appreciated.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Joe Clarke Tue, 04/27/2010 - 18:39

Go to RME > Tools > Syslog > Message Filters, and create a new filter to drop this message (i.e. make sure the filter mode is set to DROP):

Facility : HARDWAREMON

Sub-facility : *

Severity : 2

Mnemonic : 10

Description : *Chassis intrusion alarm is inactive*

This will keep the message from being logged to the RME database as well as preventing an automated action email from going out.

mdragatsis Tue, 04/27/2010 - 18:57

Thanks Joe, ive set the filter in msg filters.

1. Just some clarification, in the message filters section, were all other alerts are listed, is this the list for all alerting on all devices right ?

2. That code  for facility > HARDWAREMON <, what does that mean ? ( vpn gateway code ?)  is there a url where lists what all codes are for devices ?

3. Also other ciscoworks alerts, to change their severity from 1-3 to 4-5 is it just a matter of changing the sev number to like 3 or something.

Sorry for all the q's, but your help is appreciated.

mdragatsis Tue, 04/27/2010 - 19:03
Joe Clarke Tue, 04/27/2010 - 22:28

Post the full email being generated as well as the syslog.log which contains the raw message received by the device.

mdragatsis Tue, 04/27/2010 - 22:35

this is the full email alert we get -




Syslog message generated from device au-aapvpn000: Apr 28 15:31:28 x.x.x.x 73162144: 2010 Apr 28 17:39:16.740 +0900 +11:00 %HARDWAREMON-2-10: RPT=227403: Chassis intrusion alarm is inactive

Joe Clarke Tue, 04/27/2010 - 22:37

Post the NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/filters.dat file.

Joe Clarke Tue, 04/27/2010 - 22:27

1. Typically filters apply to all devices.  However, you can have a filter only apply to a subset of devices.  This is done from the first configuration screen when you define or edit a filter.

2. The HARDWAREMON is the syslog facility.  Typically, all syslogs generated by a given device and software release are documented in the System and Error Messages Guide for that version of code.  You can search on Cisco.com for the appropriate guide for your device and version of code.

3. RME cannot modify the severity of syslog messages.  They are assigned by the device.  IOS devices which have Embedded Syslog Manager support can manipulate messages on the fly to change severity.

Actions

This Discussion