Configuring an Event Rule so SPECTRUM will not alarm on a single instance of an Authentication Failure trap

Products

• Spectrum

Issue/Introduction

Configuring an Event Rule so SPECTRUM will not alarm on a single instance of an Authentication Failure trap

Environment

Release: Any
Component:

Resolution

The solution is to create an Event Rate Counter or Event Rate Window rule on the 0x1030a event using the Event Configuration Editor. Follow these basic steps:

1. Launch the Event Configuration Editor

2. Find and select the 0x1030a event

3. Create a copy of the 0x1030a event and make a note of the new Event ID

4. Remove the alarm assertion from the 0x1030a event

5. Create an Event Rate or Event Rate Window event rule on the 0x1030a event. Choose the number of occurrences, set the time interval and select the Event ID created in step 3 as the event to generate.

6. Update the SpectroSERVER Event Cache.

The following is an example of how the new EventDisp entry would look like if the an Event Rate Counter rule were configured to generate event 0xfff00000 if 5 Authentication Failure events (0x1030a) occurred within 10 seconds.

 0x1030a E 50 R CA.EventRateCounter, 5, 10, "0xfff00000 -:-"

 

Additional Information

Please reference the "Event Configuration" section of the documentation for more information.