Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

MARS - "Sudden increase of traffic to a port" rule

Hello. I duplicated the system rule "Sudden increase of traffic to a port" in MARS and it blew out the original system rule and now shows up as a user rule. It doesn't appear to be working either. It is active. Not sure what to make of this, and neither is TAC. Anybody every mess up a system rule like this? Anyway to recover it? Thanks!

1 REPLY
New Member

Re: MARS - "Sudden increase of traffic to a port" rule

I upgraded to 4.2.2 and the rule seems to have been restored as a system rule. I noticed that it is showing up in our morning report (Event Types Ranked by Sessions), but we are not recieving an email or page for this rule firing (email/SMS notification works for all other rules). I ran a query for this event for the time period of the report it showed up on and no results were returned. Any thoughts would be appreciated. Thanks.

Christine

151
Views
0
Helpful
1
Replies
作成コンテンツを作成するには してください