×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

3111 alarm

Unanswered Question
Nov 5th, 2001
User Badges:

How to exclude 3111 alarms? tried normal way, but could not find the 3111 alarm in alrm list.

it is for sircam worm.our smtp server is unix box, and amount of 3111 alarms is more than overwelming. sensors are 3.0(2) S10, Director is 2.2.3.


thanks,


ross

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
marcabal Mon, 11/05/2001 - 15:25
User Badges:
  • Cisco Employee,

The method depends on the management platform.

For CSPM use hte Advanced Filter Tab, and for nrConfigure use the Filter tab.


Be sure to have the latest signature update loaded on both the sensors as well as the management stations. Without it on the management station the management station won't know how to exclude it.


In a worst case scenario you can:

1)If using nrConfigure manually add the following line to the bottom of packetd.conf on the sensor

then double click on the sensor in nrConfigure

donwload the change packetd.conf file with the change

then apply the same version in order to have the sensor read the configuration.


RecordOfExcludedPattern 3111 * *

example:

RecordOfExcludedPattern 3111 * * 10.10.10.10


2) If using CSPM then place the above line in the Epilogue field, update the database, and approve the configuration. Items in the Epilogue will be added to packetd.conf.


If you just want to turn the signature off then

1) If using nrConfigure set the severity level of the sig to 0

2) If using CSPM desable the signature by removing the enable checkmark

r.zekic Wed, 11/07/2001 - 06:22
User Badges:

Hi All,


It's me again. Can anyone help me in finding the way to exclude

alarm 3111 using UNIX Director, HP Open view GUI. I do not use CSPM for NT. Is this some sort of bug or problem in software so it do not see all signatures?


thanks,


ross

marcabal Wed, 11/07/2001 - 10:28
User Badges:
  • Cisco Employee,

This may be an issue with the software.

I would recommend calling the TAC so they can enter a bug.


As a workaround try entering a RecordOfExcludedPattern line directly in packetd.conf:

Format: RecordOfExcludedPattern


So to exclude 3111 with mutliple destination addresses:

RecordOfExcludedPattern 3111 * * 10.1.1.1,10.1.1.5,10.1.1.6

Or for an entire network:

RecordOfExcludedPattern 3111 * * 10.1.1.1-10.1.1.255


Then next time you open the sensor in nrConfigure it should ask to download the new packetd.conf file.

Answer yes.

nrConfigure should read in the new line and repeat in all future changes to packetd.conf, though I have not tested to verify it.



ekrishna Wed, 11/07/2001 - 22:03
User Badges:

The Signature 3111 is in the filter but it is not in the order.

You could see the 3111 signature next to 3992 or above 4000 signature

Actions

This Discussion