"custom event creation"

Unanswered Question
Sep 21st, 2010
User Badges:

Hi all

I would like to recieve a mail everytime the user pnadmin logs in (that is not just any admin but pnadmin).

I can not find an event type under "info/misc/cs-mars" matching this.

Is it possible to create (or modify an existing) a custom eventtype in Mars?

How is this done?

looking forward to any answer

/JanV - Infrastructure

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Scott Fringer Fri, 09/24/2010 - 04:55
User Badges:
  • Cisco Employee,


  To generate an incident for just successful pnadmin user logins it would be most effective to create a rule based on a keyword query limited to your CS-MARS as the reporting device.  If you are interested in any pnadmin activity, you could use just 'pnadmin' as the keyword; this should catch both successful and failed logins.  If you want to restrict it to successful pnadmin logins, you could use two keywords ANDed together; 'pnadmin' and 'login successful'.  By making this a rule you can assign the email action to be alerted when this rule fires.


KS Infrastruktur Mon, 10/04/2010 - 14:06
User Badges:

Scott - your answer was very helpfull!

Thanx a lot! ! !

/Jan - KS-Infrastructure



This Discussion