How to change message filters

[USD SmartAlerts]

I have several message filters that were created by my predecessor who is no longer with the company. Is there a way to edit them or do I have to remove/re-add them?

[ppreenja]

Hi ,

Please check on the below article that will be helpful to provide you with more information on editing or creating message filters:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01000.html

Cheers,
Pratham

[ppreenja · Accepted solution]

Hi ,

To answer your exact query we can't make the changes in the message filter on the CLI which is already added in the ESA.
You have to create new filters and re-add them via CLI only.

You can make use of the LIST and DETAIL option to check the details of the existing filters. Copy all the filters in the notepad and make the changes.
After this either rename all the filters or you have to remove the pre-existing filters with the same name to add them otherwise ESA will throw below error:
"(FILTER NAME) has been marked invalid for these reasons: Duplicate filter name."
OR you can make use of the IMPORT and EXPORT options available to achieve the same.
You can refer to the article shared previously for the same.

Below are all the options visible in message filters:

Choose the operation you want to perform:
- NEW - Create a new filter.
- DELETE - Remove a filter.
- IMPORT - Import a filter script from a file.
- EXPORT - Export filters to a file
- MOVE - Move a filter to a different position.
- SET - Set a filter attribute.
- LIST - List the filters.
- DETAIL - Get detailed information on the filters.
- LOGCONFIG - Configure log subscriptions used by filters.
- ROLLOVERNOW - Roll over a filter log file.
- CLUSTERSET - Set how filters are configured in a cluster.
- CLUSTERSHOW - Display how filters are configured in a cluster.

I hope this clarifies your query.

Cheers,
Pratham