topic Sensor Health Thresholds in Network Security https://community.cisco.com/t5/network-security/sensor-health-thresholds/m-p/1255845#M76595 <P>We now have the concept of system health which can be viewed in the IDM Dashboard, but can/could the same monitors be configured to send a snmptrap on threshold breach?</P> Sun, 10 Mar 2019 11:43:52 GMT james.grayson 2019-03-10T11:43:52Z Sensor Health Thresholds https://community.cisco.com/t5/network-security/sensor-health-thresholds/m-p/1255845#M76595 <P>We now have the concept of system health which can be viewed in the IDM Dashboard, but can/could the same monitors be configured to send a snmptrap on threshold breach?</P> Sun, 10 Mar 2019 11:43:52 GMT https://community.cisco.com/t5/network-security/sensor-health-thresholds/m-p/1255845#M76595 james.grayson 2019-03-10T11:43:52Z Re: Sensor Health Thresholds https://community.cisco.com/t5/network-security/sensor-health-thresholds/m-p/1255846#M76596 <HTML><HEAD></HEAD><BODY><P>Threshold breaches on sensor are tracked by health monitor application in the form of heartbeat messages encapsulated in evStatus events every 300 seconds as shown below :</P><P></P><P>evStatus: eventId=1172446951295212902 vendor=Cisco </P><P> originator: </P><P> hostId: qssm-230</P><P> appName: monitor</P><P> appInstanceId: 359</P><P> time: 2007/02/26 05:00:05 2007/02/26 05:00:05 UTC</P><P> healthAndSecurity: </P><P> description: Heartbeat</P><P> healthStatus: red</P><P> securityStatus: </P><P> virtualSensor: vs0</P><P> status: green</P><P>...</P><P>...</P><P></P><P>evStatus messages cannot be sent as snmp traps like evError messages. However the events that cause the threshold to exceed in some cases are also generated as evError messages which are eligible to be sent as snmptraps. Some examples are termination of some application like sensorApp or removing the monitoring interface from virtual sensor, etc. as shown below :</P><P>evError: eventId=1172446951295212899 severity=warning vendor=Cisco </P><P> originator: </P><P> hostId: qssm-230</P><P> appName: sensorApp</P><P> appInstanceId: 456</P><P> time: 2007/02/26 04:59:14 2007/02/26 04:59:14 UTC</P><P> errorMessage: name=errWarning unspecifiedWarning:There are no interfaces assigned to any virtual sensors. This can result in some packets not being monitored.</P><P></P><P>Hope this helps</P></BODY></HTML> Wed, 05 Aug 2009 23:14:31 GMT https://community.cisco.com/t5/network-security/sensor-health-thresholds/m-p/1255846#M76596 mkodali 2009-08-05T23:14:31Z Re: Sensor Health Thresholds https://community.cisco.com/t5/network-security/sensor-health-thresholds/m-p/1255847#M76598 <HTML><HEAD></HEAD><BODY><P>That is indeed useful info, thanks for replying <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P></BODY></HTML> Thu, 06 Aug 2009 15:38:41 GMT https://community.cisco.com/t5/network-security/sensor-health-thresholds/m-p/1255847#M76598 james.grayson 2009-08-06T15:38:41Z