cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
300
Views
0
Helpful
3
Replies

Customizing Security Monitor

emusican
Level 1
Level 1

Using Security Monitor 1.2, on the event viewer is there a way to ONLY view low alarms? If I set the monitor to low Ill get medium and high alarms as well on the EV and I dont want that because it would take an hour to load.

3 Replies 3

ywadhavk
Cisco Employee
Cisco Employee

Hi Eric,

Sorry, but I didn't get the question. Do you or you don't want the low severity alarms to be seen on the Event viewer? If so, go to the Security Monitor-->Devices--> select the device-->Edit-->nad set the minimum level of logging to Medium. This way, there won't be any low severity alarms that will show up in the EV.

thanks,

yatin

Basically, Id like to be able to set my viewer to see only low severity alarms. I dont want to see all of the informational alarms as well.

Hi Eric,

The way the logic is currently setup in the Security Monitor Event Viewer is that if a user needs to see Low Severity alarms then, it is more than likely that the alarms having higher severity are important for this user as well. Hence you will see all the Low, Medium and High severity alarms. Currently there are no filters that you can utilize to get just the alarms that you want. These alarms has to still populate the IEV database. The sensor can hold at the max only upto 4GB worth of events. After that, it overwrites the older events.

You could use IEV as it has filters capability.

Thanks,

yatin