Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Event Action Filters (difference between column Active & Enabled?)

I have a IPS4260, running v6.0(3).

Under "Configuration" > "Event Action Rules" > "Event Action Filter".

What is the difference between column "Active" and "Enabled"? This is confusing.


Re: Event Action Filters (difference between column Active & Ena

I would guess that it's the same as the signatures and the basic premise is that when a filter is disabled, but still gets it still consumes resources on the sensor. If you inactivate the filter, it does not.

Cisco Employee

Re: Event Action Filters (difference between column Active & Ena

Event action filters are evaluated in a specified order. Active means that a filter participates in the order. Enabled means that it can perform a filtering action. Use Disable when you want to preserve the order, but not perform the action (e.g. if you want to turn it off for debugging, but want to keep it's place in the list later). Use Inactive when you don't want the filter in the ordering at all (e.g. if you want to keep it as a reminder, but don't plan to use it again). The filter list is displayed by CLI and IDM in logical order - first all of the Active filters in their specified order, and then all of the Inactive filters. I don't think the designers really intended to have 2 similar options; it is more a side effect of the data model used for storing the configuration.

Re: Event Action Filters (difference between column Active & Ena

Thank you for your answer. I wish you guys could put a more helpful description in the CLI Guide, IDM Guide and Onine Help. Currently the CLI guide does not even mention one of these options. Online/IDM guide are also very vague.




Re: Event Action Filters (difference between column Active & Ena

Thanks for the clarification Sean. I like your description...any chance you can have it included in the user guide and/or context help?