cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
540
Views
5
Helpful
3
Replies

IPS sigs with no MARS event type?

mhellman
Level 7
Level 7

What is with the new IDS alarms in MARS that are mapping to blank event types (or at least appear blank)? Has anyone else noticed this? see attached incident and raw message. This has been going on for weeks now.

1 Accepted Solution

Accepted Solutions

orbyn
Level 1
Level 1

I am seeing the same thing. Check out CSCso69721. No fix or workaround is available yet from what I can see.

View solution in original post

3 Replies 3

orbyn
Level 1
Level 1

I am seeing the same thing. Check out CSCso69721. No fix or workaround is available yet from what I can see.

Thanks. Only Cisco would have the cojones to call such a failure in a SIM "cosmetic".

-sigh-

wiluszm
Level 1
Level 1

Uggh... I feel your pain. We have events firing like this as well. At first it caused our custom mailer program to bomb out as the XML branches were blank. Lattest patch does not fix the issues. I consider this *far* from simply cosmetic.

-Mike

http://cs-mars.blogspot.com

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card