Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Change/stop alerts that ciscoworks sends out

Hi,

Im trying to find were in ciscoworks, i can adjust the sev levels of various devices.

For eg - i get this alert

Syslog message generated from device au-aapvpnxxx: Apr 28 10:48:01 10.x.x.x 73090715: 2010 Apr 28 12:56:10.310 +0900 +11:00 %HARDWAREMON-2-10: RPT=227329: Chassis intrusion alarm is inactive.

It comes up as sev 1-3.

I dont want this alerting, cause its only a chassis intrusion alarm.

What would be the best thing to do, stop this alert from emailing. ? ( were do you go to change this / stop it etc..)

Help appreciated.

8 REPLIES
New Member

Re: Change/stop alerts that ciscoworks sends out

Im running LMS 3.2

Cisco Employee

Re: Change/stop alerts that ciscoworks sends out

Go to RME > Tools > Syslog > Message Filters, and create a new filter to drop this message (i.e. make sure the filter mode is set to DROP):

Facility : HARDWAREMON

Sub-facility : *

Severity : 2

Mnemonic : 10

Description : *Chassis intrusion alarm is inactive*

This will keep the message from being logged to the RME database as well as preventing an automated action email from going out.

New Member

Re: Change/stop alerts that ciscoworks sends out

Thanks Joe, ive set the filter in msg filters.

1. Just some clarification, in the message filters section, were all other alerts are listed, is this the list for all alerting on all devices right ?

2. That code  for facility > HARDWAREMON <, what does that mean ? ( vpn gateway code ?)  is there a url where lists what all codes are for devices ?

3. Also other ciscoworks alerts, to change their severity from 1-3 to 4-5 is it just a matter of changing the sev number to like 3 or something.

Sorry for all the q's, but your help is appreciated.

New Member

Re: Change/stop alerts that ciscoworks sends out

Joe, looks like im still getting the alerts emailed out.





gtsau.datacomms@au.pwc.com
28/04/2010 12:02 PM
To
cc

Subject
CiscoWorks Alert - Severity 1-3



Syslog message generated from device au-aapvpnxx: Apr 28 12:01:26 x.x.x.x 73112433: 2010 Apr 28 14:09:36.640 +0900 +11:00 %HARDWAREMON-2-10: RPT=227353: Chassis intrusion alarm is active.

Any ideas ?

Cisco Employee

Re: Change/stop alerts that ciscoworks sends out

Post the full email being generated as well as the syslog.log which contains the raw message received by the device.

New Member

Re: Change/stop alerts that ciscoworks sends out

this is the full email alert we get -




Syslog message generated from device au-aapvpn000: Apr 28 15:31:28 x.x.x.x 73162144: 2010 Apr 28 17:39:16.740 +0900 +11:00 %HARDWAREMON-2-10: RPT=227403: Chassis intrusion alarm is inactive

Cisco Employee

Re: Change/stop alerts that ciscoworks sends out

Post the NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/filters.dat file.

Cisco Employee

Re: Change/stop alerts that ciscoworks sends out

1. Typically filters apply to all devices.  However, you can have a filter only apply to a subset of devices.  This is done from the first configuration screen when you define or edit a filter.

2. The HARDWAREMON is the syslog facility.  Typically, all syslogs generated by a given device and software release are documented in the System and Error Messages Guide for that version of code.  You can search on Cisco.com for the appropriate guide for your device and version of code.

3. RME cannot modify the severity of syslog messages.  They are assigned by the device.  IOS devices which have Embedded Syslog Manager support can manipulate messages on the fly to change severity.

434
Views
0
Helpful
8
Replies