Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Signature Engines Ver3.0 Parameter

Just tune existing signature directly on the Sensor via the Signture Wizard.

I'd like to use GlobalSumamrize mode to reduce the alarms.

I set Parameters below:(SIGID=5081)

2 - AlarmThrottle = GlobalSummarize

15 - ThrottleInterval = 20

I got the first aralm that start a summary, but I couldn't get SUMMARY ALARM,

and never get the alarm of this signature any longer.

How can I get SUMMARY ALARM and this parameter settings is collect?

1 REPLY
New Member

Re: Signature Engines Ver3.0 Parameter

Sorry for the tardy response.

There was a known defect in 3.0(1) with Summarize modes. The WEB alarms (such

as your 5081) would behave as FireOnce when set into a Summarize mode.

(This seems to be what you are experiencing).

Version 3.0(2) fixed the Summarize problems.

If you are already using 3.0(2), this may be an undiscovered defect.

Please give us information on your current version and your update history in the 3.0 train.

Thanks,

-JK

92
Views
0
Helpful
1
Replies
CreatePlease to create content