Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

Gold

IPS sigs with no MARS event type?

What is with the new IDS alarms in MARS that are mapping to blank event types (or at least appear blank)? Has anyone else noticed this? see attached incident and raw message. This has been going on for weeks now.

1 ACCEPTED SOLUTION

Accepted Solutions
New Member

Re: IPS sigs with no MARS event type?

I am seeing the same thing. Check out CSCso69721. No fix or workaround is available yet from what I can see.

3 REPLIES
New Member

Re: IPS sigs with no MARS event type?

I am seeing the same thing. Check out CSCso69721. No fix or workaround is available yet from what I can see.

Gold

Re: IPS sigs with no MARS event type?

Thanks. Only Cisco would have the cojones to call such a failure in a SIM "cosmetic".

-sigh-

Bronze

Re: IPS sigs with no MARS event type?

Uggh... I feel your pain. We have events firing like this as well. At first it caused our custom mailer program to bomb out as the XML branches were blank. Lattest patch does not fix the issues. I consider this *far* from simply cosmetic.

-Mike

http://cs-mars.blogspot.com

120
Views
5
Helpful
3
Replies