cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
272
Views
0
Helpful
2
Replies

CSA RULE SET TO NOT LOG BUT STILL SHOWING UP

dclewis
Level 1
Level 1

I HAVE A CSA RULE FOR ICMP TO DENY "pre V4.5 description: Detect network scans and SYN flood attacks" MY RULE NUMBER 940 WHICH I BELIEVE DOESN'T MEAN ANYTHING SPECIFIC.

WHEN I SET IT TO DENY AND NOT LOG. I AM STILL RECEIVING SERVAL MESSAGES PER MINUTE.

ANY THOUGHTS

THANKS IN ADVANCE

2 Replies 2

gfullage
Cisco Employee
Cisco Employee

Is the group in test mode? In test mode rules under that group will always log, regardless of the setting. The theory is that if you're testing something you want to see it logging, and when you later take it out of test mode the logging will be off as you have set.

These are servers that are out of test mode.