How to configure rule for CPU Utilization going beyond 30%
I want to construct a rule in CSMARS, which will send a mail to me, once it recieves CPU Utilization greater than 30% for any configured device.
I have vreated one rule for event CPU Utilization Abnormally high. Is there any way to tune an event definition so that it trigger the event for CPU going high to a randomly choosen number, say 10%, 30% etc?
Also when i recieve a mail from CSMARS for "Rule Name: System Rule: Resource Issue: Network Device" (another configured rule), the mail contain the incident information. Is there any way to put some more details like reporting device etc on mail content? The mail comes with following contents,
Re: How to configure rule for CPU Utilization going beyond 30%
The CS-MARS resource-based rules are not configurable or exposed for creating custom rules. You would be better served by a true network management/monitoring tool; CS-MARS is designed as a security incident correlation and reporting tool.
In regard to including more incident details in the email received, this is not currently customizable. The email action provides the details you have noted. You may want to look into using the XML notification which does include substantially more detail of the firing incident. This output is discussed in the user guide at the following link:
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...