Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Silver

Need help with a rule (CSMARS)..

I wrote a rule with the intent of it firing upon events originating only from public ip addresses AND only for yellow OR red severity levels. However this rule still fires on green severity events. Can any one see why from looking at the rule in the attached graphic?

Thank you,

Mike

P.S. Sorry about the double post.

3 REPLIES
Gold

Re: Need help with a rule (CSMARS)..

Can you paste a picture of the actual events in an incident? I believe green-level events can still be part of the incident, but you should still have at least 10 yellow or 1 red event also part of the incident.

Silver

Re: Need help with a rule (CSMARS)..

As you can see in the new graphic, the incident indicates that it matched the rule and is a GREEN level event.

Silver

Re: Need help with a rule (CSMARS)..

I found the problem. There was a red severity event wrapped up in the session that was not visible until drilling all the way down to it. Thanks for the ear.

-mike

118
Views
3
Helpful
3
Replies