Hi,

I have created dummy rules to drop any events that is rated as normal activities such as when switch interface status changed to up/down everytime users on/off their PCs, or when firewall translation is expired once the connectivity/sessions is terminated. Same goes to false positives where MARS will either drop or logged the events for any events matched with the customized rules.

However, when I changed the dummy rules to 'inactive' so that MARS will log and display everything back to normal, the status displayed on the main page under "Drop" is still increased. Now, no events are displayed on the main screen like before.

Any suggestions/help?

Thanks

AK