Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Filters seemingly ignored?

'lo all.

It seems in the last 2 days or so, one of our filters is seemingly being ignored. I double checked on the sensor itself, and the filter is still in tact and looks the same as ever, however now our event viewer is getting filled up with the traffic that it used to pear out. Has anyone else had this problem? Any thoughts as to why this would happen? The only changes we've made recently have been sig updates, but nothing we've done has seemed to coincide with when the problem started.

New Member

Re: Filters seemingly ignored?

I have more than one filter being ignored. I've only updated sigs as well. I think my problem started at S70. Re-applying them from IDSMC doesn't seem to help either.

Anyone else?

New Member

Re: Filters seemingly ignored?

I'm seeing this as well. I've just disabled the alarm(s) for now as I don't really have time to mess with it.