×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Customizing Security Monitor

Unanswered Question
Oct 24th, 2003
User Badges:

Using Security Monitor 1.2, on the event viewer is there a way to ONLY view low alarms? If I set the monitor to low Ill get medium and high alarms as well on the EV and I dont want that because it would take an hour to load.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
ywadhavk Mon, 10/27/2003 - 08:39
User Badges:
  • Cisco Employee,

Hi Eric,

Sorry, but I didn't get the question. Do you or you don't want the low severity alarms to be seen on the Event viewer? If so, go to the Security Monitor-->Devices--> select the device-->Edit-->nad set the minimum level of logging to Medium. This way, there won't be any low severity alarms that will show up in the EV.


thanks,

yatin

emusican Mon, 10/27/2003 - 09:03
User Badges:

Basically, Id like to be able to set my viewer to see only low severity alarms. I dont want to see all of the informational alarms as well.

ywadhavk Tue, 10/28/2003 - 06:59
User Badges:
  • Cisco Employee,

Hi Eric,

The way the logic is currently setup in the Security Monitor Event Viewer is that if a user needs to see Low Severity alarms then, it is more than likely that the alarms having higher severity are important for this user as well. Hence you will see all the Low, Medium and High severity alarms. Currently there are no filters that you can utilize to get just the alarms that you want. These alarms has to still populate the IEV database. The sensor can hold at the max only upto 4GB worth of events. After that, it overwrites the older events.


You could use IEV as it has filters capability.


Thanks,

yatin

Actions

This Discussion